Malicious Package

Overview syft-acp-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in syft-acp-uikit (npm)

The syft-acp-uikit package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63706

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-3730 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-3730 Source advisory: OSV:PYSEC-2026-1970...

azureml-designer-pytorch-modules (>=0.0.1, <=0.0.12), deberta (0.1.4) +10 more potentially affected by CVE-2025-3730 via torch (1.3.0)

torch PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - azureml-designer-pytorch-modules =0.0.1, =0.0.3, =1.3.0, =0.1.0, =0.1.0, =0.2.0a2, =0.1.0, =0.1.1 Source cves: CVE-2025-3730 Source advisory:...

artificienlib (>=0.1.1, <=0.1.6), fed-rf-mk (>=0.0.5rc1, <=1.0.0) potentially affected by CVE-2026-31220 via syft (>=0.2.9, <=0.9.5)

syft PYPI version =0.2.9, =0.1.1, =0.0.5rc1, =1.0.0 Source cves: CVE-2026-31220 Source advisory: OSV:PYSEC-2026-546...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: knative-serving, skaffold, zarf-fips, argo-workflows-fips, amazon-ssm-agent-fips, kube-arangodb-fips, snyk-cli, scorecard, juicefs, step-kms-plugin-fips, gitea-fips, trufflehog-fips, commercial-grafana, docker-machine-driver-harvester, chainloop-cli-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: skaffold, kube-arangodb-fips, crossplane-provider-azure-storagesync, scorecard, trufflehog-fips, kubernetes-dashboard, tekton-chains, buildah-fips, external-secrets-fips, fulcio-fips, crossplane-provider-azure-storage, reports-server, terraform-provider-tls,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: skaffold, kube-arangodb-fips, crossplane-provider-azure-storagesync, scorecard, trufflehog-fips, kubernetes-dashboard, tekton-chains, buildah-fips, external-secrets-fips, fulcio-fips, crossplane-provider-azure-storage, reports-server, terraform-provider-tls,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: external-secrets-operator, wolfictl, go-discover, k3s, kubescape, gitlab-kas, zarf, kubernetes-dashboard, step, act, podman, nuclei, cilium-cli, docker-machine-driver-harvester, pulumi-language-java, gomplate, osv-scanner, gptscript, openbao, prometheus-operator, kin...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: neuvector-fips, skaffold, harvester-fips, kaniko, zarf-fips, kube-arangodb-fips, scorecard, datadog-agent, tekton-pipelines-fips, tigera-operator-fips, rancher, k8sgpt, trivy-fips, beats-fips, cluster-api-helm-controller-fips, consul-k8s, helm-operator, docker-compos...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: neuvector-fips, skaffold, harvester-fips, kaniko, zarf-fips, kube-arangodb-fips, scorecard, datadog-agent, tekton-pipelines-fips, tigera-operator-fips, rancher, k8sgpt, trivy-fips, beats-fips, cluster-api-helm-controller-fips, consul-k8s, helm-operator, docker-compos...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: neuvector-fips, skaffold, harvester-fips, kaniko, zarf-fips, kube-arangodb-fips, scorecard, datadog-agent, tekton-pipelines-fips, tigera-operator-fips, rancher, trivy-fips, beats-fips, cluster-api-helm-controller-fips, consul-k8s, helm-operator, docker-compose,...