MAL-2026-656 Malicious code in jshint-groups (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf7ad9a58a15b025d84def4a32761ec77338fbcda7ef3ae459602eacfaf4595 The package jshint-groups was found to contain malicious code. Source: ghsa-malware fe1d6fde4a749fdb784071c856d26761b12fdceffae0020f2492a4a845eb04f4...

PT-2026-6506

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

BIT-DISCOURSE-2026-24742 Discourse staff action logs expose sensitive information to moderators

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...

Malicious code in picking-miniapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65c40c2b2607ac2d8df224c24ff7fcc349a20993fadc53e544289d10a24a510 The package picking-miniapp was found to contain malicious code. Source: ghsa-malware 0d2a7046f9c602dfce90cc2c44cbbd8c7d8c9749929258f31e30fa899794e23...

Malicious code in react-native-expofp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4359b8fd752707d568aa82cc795ecb3a73be0444e93f02795686a048bc2de8a1 The package react-native-expofp was found to contain malicious code. Source: ghsa-malware...

MAL-2026-647 Malicious code in react-native-expofp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4359b8fd752707d568aa82cc795ecb3a73be0444e93f02795686a048bc2de8a1 The package react-native-expofp was found to contain malicious code. Source: ghsa-malware...

Malicious code in dise-pkt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02da19d128c79fa9465ba506ff8f53abb3ef541a1da253174255be017c9fd97 The package dise-pkt was found to contain malicious code. Source: ghsa-malware 58b8c2811e173e83d76597b5cb08d80de79cbc72396b7ba7957ed6c15a6003a2 Any...

MAL-2026-644 Malicious code in dise-pkt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02da19d128c79fa9465ba506ff8f53abb3ef541a1da253174255be017c9fd97 The package dise-pkt was found to contain malicious code. Source: ghsa-malware 58b8c2811e173e83d76597b5cb08d80de79cbc72396b7ba7957ed6c15a6003a2 Any...

Malicious code in @hemanshu_patil/xcode-windows-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 044c927baff7d33a20876552aa27d1a0d5167313b6bc7775fb8b955ebf831e11 The package @hemanshupatil/xcode-windows-x64 was found to contain malicious code. Source: ghsa-malware...

Malicious code in @hemanshu_patil/xcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92580bc2a85c310fea71fe37f7acd35ce4f2662de3983ddd9357a4391208c790 The package @hemanshupatil/xcode was found to contain malicious code. Source: ghsa-malware...

Malicious code in libsignal-yazxzpedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9ba3f94d59737d6d94cdf9e7fc825a792d62a213daba9d5b778e56ac35d459 The package libsignal-yazxzpedia was found to contain malicious code. Source: ghsa-malware...

Malicious code in yazxzpedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f94694d3882914e6f75cc35db5533b7d7c4d9caebb2631033de332d3c49e562 The package yazxzpedia was found to contain malicious code. Source: ghsa-malware e97d515edc36ba99b0d5fa4cc5cd35798ff96229f05a9f93ba6dbef0631f1ac0 Any...

MAL-2026-648 Malicious code in yazxzpedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f94694d3882914e6f75cc35db5533b7d7c4d9caebb2631033de332d3c49e562 The package yazxzpedia was found to contain malicious code. Source: ghsa-malware e97d515edc36ba99b0d5fa4cc5cd35798ff96229f05a9f93ba6dbef0631f1ac0 Any...

CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

Former Google Engineer Convicted of Stealing AI Secrets for China

A 38 year old was convicted on seven counts of economic espionage and seven counts of theft of trade secrets following an 11 day trial...

CLEANSTART-2026-QJ89068 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Multiple security vulnerabilities affect the external-secrets-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...

CLEANSTART-2026-JM84344 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CLEANSTART-2026-DO54415 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...