Malicious Package

Overview syft-acp-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

Malicious code in syft-acp-uikit (npm)

The syft-acp-uikit package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63706

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-3730 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-3730 Source advisory: OSV:PYSEC-2026-1970...

azureml-designer-pytorch-modules (>=0.0.1, <=0.0.12), deberta (0.1.4) +10 more potentially affected by CVE-2025-3730 via torch (1.3.0)

torch PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - azureml-designer-pytorch-modules =0.0.1, =0.0.3, =1.3.0, =0.1.0, =0.1.0, =0.2.0a2, =0.1.0, =0.1.1 Source cves: CVE-2025-3730 Source advisory:...

artificienlib (>=0.1.1, <=0.1.6), fed-rf-mk (>=0.0.5rc1, <=1.0.0) potentially affected by CVE-2026-31220 via syft (>=0.2.9, <=0.9.5)

syft PYPI version =0.2.9, =0.1.1, =0.0.5rc1, =1.0.0 Source cves: CVE-2026-31220 Source advisory: OSV:PYSEC-2026-546...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: livekit-cli, crossplane-provider-aws-bedrockagent, nerdctl, crossplane-provider-aws-elasticsearch-fips, crossplane-provider-aws-cloudformation-fips, ollama-fips, dagger, gitlab-pages, crossplane-provider-aws-directconnect, buildah, cloudbeat-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: livekit-cli, crossplane-provider-aws-bedrockagent, nerdctl, crossplane-provider-aws-elasticsearch-fips, crossplane-provider-aws-cloudformation-fips, ollama-fips, dagger, gitlab-pages, crossplane-provider-aws-directconnect, buildah, cloudbeat-fips,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: skaffold, apply-cve-bump, frankenphp-8.3, grype-fips, trivy-operator-fips, nerdctl, vault, omnictl-multiarch, trufflehog-fips, docker-cli-buildx, flux-fips, zitadel, dagger, terraform-fips, commercial-expanso-edge, kine, opentelemetry-collector, kube-state-metrics,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: skaffold, nerdctl, docker-cli-buildx, dagger, kine, opentelemetry-collector, pulumi, buildah, argo-cd, minio, flux-source-controller, mattermost, podman, gitlab-kas, helm, kaf, k9s, trivy-operator, loki, kubernetes, falco-no-driver, go-discover, prometheus-operator,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: eksctl, skaffold, livekit-cli, grype-fips, trivy-operator-fips, buildkitd-fips, kgateway, docker-cli-buildx, dagger, crossplane-fips, consul-k8s-fips, cloudbeat-fips, kubescape-operator-fips, amazon-ecs-agent, crossplane, kubevela-fips, beats-fips, manifest-tool,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: eksctl, skaffold, livekit-cli, grype-fips, trivy-operator-fips, buildkitd-fips, kgateway, docker-cli-buildx, dagger, crossplane-fips, consul-k8s-fips, cloudbeat-fips, kubescape-operator-fips, amazon-ecs-agent, crossplane, kubevela-fips, beats-fips, manifest-tool,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: eksctl, skaffold, livekit-cli, grype-fips, trivy-operator-fips, buildkitd-fips, kgateway, docker-cli-buildx, dagger, crossplane-fips, consul-k8s-fips, cloudbeat-fips, kubescape-operator-fips, amazon-ecs-agent, crossplane, kubevela-fips, beats-fips, manifest-tool,...