MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

Malicious code in polyprompt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52da21b792fba3cc472cb67f1a5b445786802d67b6cf81b45409acdab8724c17 lib/report.js resolves the installer's git/GitHub email through gh api user/emails, git config, npm config, and environment variables, then POSTs a...

Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...

Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f468779704fb38dd80ed26eabb01f4afdfef486ebb645d99fc07c36dcb479cf The package published as 'routerbase-mcp' declares a bin named 'install-email-research' and ships lib/report.js which collects the installer's email...

MAL-2026-11463 Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...

Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...

Malicious code in iac-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90ccff89d665d28ad35ad8c285427a56af2c0d5862b432a7de604a99a0358d9 lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, executes local commands via execSync,...

MAL-2026-11467 Malicious code in iac-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90ccff89d665d28ad35ad8c285427a56af2c0d5862b432a7de604a99a0358d9 lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, executes local commands via execSync,...

MAL-2026-11454 Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...

CVE-2026-54725

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

MAL-2026-11461 Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

EUVD-2026-51568

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

MAL-2026-11497 Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...

Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...

Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...