Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47761909a1686ad1db2239f5055c8526e38ac88c07060c886157d157d15b4315 package.json declares a preinstall script that runs node index.js on npm install. index.js collects host identifiers os.hostname, os.platform, os.arc...

Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed758e4154bc29bda7b5ee78165766980d88068090a9853a2243509d97c11152 [email protected] executes a preinstall script index.js that collects installer host identifiers — os.hostname, os.platform, os.arc...

MAL-2026-11098 Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed758e4154bc29bda7b5ee78165766980d88068090a9853a2243509d97c11152 [email protected] executes a preinstall script index.js that collects installer host identifiers — os.hostname, os.platform, os.arc...

MAL-2026-11102 Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...

MAL-2026-11105 Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47761909a1686ad1db2239f5055c8526e38ac88c07060c886157d157d15b4315 package.json declares a preinstall script that runs node index.js on npm install. index.js collects host identifiers os.hostname, os.platform, os.arc...

MAL-2026-11100 Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4808d7fab80b2202538cad6c5a1be4d62eb973ac35eb3a431fdf33f68b67ee [email protected] wires scripts.preinstall to node index.js, so on npm install the package auto-executes code that collects host...

Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4808d7fab80b2202538cad6c5a1be4d62eb973ac35eb3a431fdf33f68b67ee [email protected] wires scripts.preinstall to node index.js, so on npm install the package auto-executes code that collects host...

MAL-2026-11103 Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...

MAL-2026-11099 Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497 The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoParseDate function invokes...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

MAL-2026-11095 Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...

MAL-2026-11104 Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...

BIT-OPENBAO-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

BIT-OPENBAO-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...

BIT-OPENBAO-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

MAL-2026-11087 Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...

Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...