CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

Malicious code in @years18/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1342694c7cf44fdd451ec464ebcee8acca8523770f147805b8b3c4a7ae225fa The package's postinstall hook node callback.js fetches three tarballs mhddos, pyroxy-full, impacket from...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

MAL-2026-13896 Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268 On npm install, the package's postinstall script callback.js / index.js fetches mhddos, PyRoxy, impacket, and multidict tarballs from...

MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

MAL-2026-13854 Malicious code in @years18/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c17b5de9890a54a8a7a1ddf14ff05488baa64612904cf577591e1b9f9a007f1a The package ships a postinstall hook node callback.js and a main entrypoint index.js, byte-identical to callback.js that both perform install-time an...

MAL-2026-13857 Malicious code in @years18/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53 The package's declared postinstall script node callback.js and its main entrypoint index.js contain identical payloads that fire on npm install and...

Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id...

MAL-2026-13859 Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4 The package presents itself as an n8n community node but ships a stub node file nodes/PwnNode.node.js, 213 bytes, description "x" whose only real...

MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

CVE-2026-18678: Improper Certificate Validation

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

PT-2026-71209

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-66806

A flaw was found in console. When the HTTPSPROXY environment variable is not configured, the console component fails to verify Transport Layer Security TLS certificates for outbound connections. A network-positioned attacker Man-in-the-Middle can exploit this vulnerability to intercept the cluste...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48159

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...