Malicious code in ulid-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cde9990177f51fd4637a17f48d850c61f3ade933fe3fce078d5846125a5fa01 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15944 Malicious code in @crysnovax/baileys-fixed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bca343c567c4a163c81912649019e99d22070a069b1c7e174a16659f6e41469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Information Exposure

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...

CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

envsec v1.0.0-rc.2

envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...

Malicious code in html_vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1617e904ee9a3f603febf67c0fac2f7a3c80032d623015264de2daf983e64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @a23842/dsh-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90a9b8f9d25fdfb423c0110bb478302a429e4746efa54bdabb2885bc4e8bce The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15879 Malicious code in dsh-waste-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff08b82d3f992d5249efc4a0914c649542386b248af94f4aea510abc51dad0d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15887 Malicious code in html_vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1617e904ee9a3f603febf67c0fac2f7a3c80032d623015264de2daf983e64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

wrongsecrets-binaries v0.3.0

wrongsecrets-binaries This is a supportive repository for OWASP WrongSecrets. Here we create our binaries which are included in the official project. Want to add a challenge related to secrets hiding in binary? Open a ticket at WrongSecrets issues. Want to fix something you found in one of the...

Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

EUVD-2026-70506

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

hulak v0.3.33

Git-native API client with encrypted secrets. REST · GraphQL · OAuth Quick Start • GraphQL Explorer • Project Layout • Documentation Run one request, a whole directory, or stay interactive hulak run ./requests/ Hulak runs request files directly from your project. It supports concurrent directory...

Malicious code in ordered-kv-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in priority-slot-queue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d9070a4736fe0ceeb43d3f01cad7456582c802e6bb0f84ab6b4e1050947316 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-time-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a259c39e0c762f33b09b298c1fe8ae606adb43422478d06979461b816edf0985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-lru-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180c50a02e5bbe5a57f622112bba7f7b01becd6cf85f6d9d4b8301699f4334b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15875 Malicious code in btree-lru-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...