PT-2026-48737

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6 Description An authorization bypass exists in Telegram interactive callbacks. Authenticated users can bypass the commands.allowFrom validation by invoking affected callbacks to mark themselves as authorized...

Malicious code in telegramlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce1afd32bb4808a41c70c2b9e7d38d36de85eef1ada8d8ae615f5df1a6f88a5c No install-time, import-time, or runtime behaviors of concern were observed in this version. The package name suggests a lightweight Telegram client...

MAL-2026-5531 Malicious code in telegramlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce1afd32bb4808a41c70c2b9e7d38d36de85eef1ada8d8ae615f5df1a6f88a5c No install-time, import-time, or runtime behaviors of concern were observed in this version. The package name suggests a lightweight Telegram client...

CVE-2026-49413

creationtimestamp| type| source ---|---|--- 2026-06-10 19:00:12+00:00| published-proof-of-concept| Telegram/s-lekdCMiFUG7sttPbwaSIszWWV6asQx86IxAh3lgAbVW0 2026-06-10 21:00:04+00:00| published-proof-of-concept| Telegram/vutlEkkKb9qIgYOqF4-LP04R3ngybqm9kGYUg8WL0zG7ih0 2026-06-27 09:51:59+00:00| see...

MAL-2026-5525 Malicious code in @solana-labs/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b0523027116b3981b0f1dfe925f01d8956eb19817aae6ea7d0022d5357fba4 Package @solana-labs/web3.js impersonates the legitimate @solana/web3.js and re-exports it as cover while running a malicious postinstall node...

Malicious code in @solana-labs/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b0523027116b3981b0f1dfe925f01d8956eb19817aae6ea7d0022d5357fba4 Package @solana-labs/web3.js impersonates the legitimate @solana/web3.js and re-exports it as cover while running a malicious postinstall node...

Malicious code in events-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac4806dc5c887c91db1f2570abcae5b98d62dfae36bea2ddb9e2449efd62eca Package name and description impersonate the popular events package Node's event emitter for all engines. The vendored events.js adds an undocumented...

MAL-2026-5528 Malicious code in events-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac4806dc5c887c91db1f2570abcae5b98d62dfae36bea2ddb9e2449efd62eca Package name and description impersonate the popular events package Node's event emitter for all engines. The vendored events.js adds an undocumented...

CVE-2026-44290

creationtimestamp| type| source ---|---|--- 2026-06-10 09:00:04+00:00| published-proof-of-concept| Telegram/ZHpMnVOz2cJfIOonPjLT3mqz43XsQAtrT-ty2tkYMtXDqE...

CVE-2026-48732

creationtimestamp| type| source ---|---|--- 2026-06-10 03:00:12+00:00| published-proof-of-concept| Telegram/MqWdWANShUnJ68DjuVipLyqHCuJpXni1SRGxasMWhR16HRA 2026-06-24 21:32:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2uixa5bt2f 2026-07-12 10:00:03+00:00|...

CVE-2026-52885

creationtimestamp| type| source ---|---|--- 2026-06-09 19:00:13+00:00| published-proof-of-concept| Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8 2026-06-26 22:17:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xwnrx5d23 2026-06-29 14:47:42+00:00| seen|...

CVE-2026-46394

creationtimestamp| type| source ---|---|--- 2026-06-09 19:00:13+00:00| published-proof-of-concept| Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8 2026-06-09 23:00:05+00:00| published-proof-of-concept| Telegram/avQcqITCN0CdPqbuzPd1c2U29MoQRxNSjCudrYTZic4II 2026-07-12 10:00:03+00:00|...

CVE-2026-00000

creationtimestamp| type| source ---|---|--- 2026-06-09 15:00:12+00:00| published-proof-of-concept| Telegram/TPZhP3a04vI9AManDnxQiLM92frB40hJI3gtpEixtxo5IZo 2026-06-09 23:00:05+00:00| published-proof-of-concept| Telegram/avQcqITCN0CdPqbuzPd1c2U29MoQRxNSjCudrYTZic4II...

CVE-2026-39023

creationtimestamp| type| source ---|---|--- 2026-06-09 11:00:17+00:00| published-proof-of-concept| Telegram/u-phHdhtXJBm23j7Z55op0F75fWfK3k9htcZvFqyTuOau08 2026-06-09 15:00:06+00:00| published-proof-of-concept| Telegram/zS0m-Smw9tMC2xQZhVRiFtrXmVStzlksgIyfU5bMHDdEXnY 2026-07-12 11:00:03+00:00|...

MAL-2026-5357 Malicious code in farming-tools-12 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+, same aicrypto-xzggg publisher and "Core utilities for blockchain development" description as swap-sdk-87/defi-tools-39. postinstall auto-execs, src/index.js harvests /.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env +...

Malicious code in farming-tools-12 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+, same aicrypto-xzggg publisher and "Core utilities for blockchain development" description as swap-sdk-87/defi-tools-39. postinstall auto-execs, src/index.js harvests /.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env +...

MAL-2026-5354 Malicious code in defi-tools-39 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+, byte-identical to swap-sdk-87. postinstall auto-execs, src/index.js harvests /.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894...

Malicious code in swap-sdk-87 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+. postinstall auto-execs, src/index.js harvests /.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 not rotated. Inflated version...

MAL-2026-5359 Malicious code in swap-sdk-87 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+. postinstall auto-execs, src/index.js harvests /.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 not rotated. Inflated version...

MAL-2026-5360 Malicious code in wallet-sdk-9 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+. postinstall auto-execs, src/index.js harvests /.ssh/idrsa+ided25519+Sol/Eth/BTC/Tron/Sui/Aptos wallets+.env+seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 not rotated. Campaign now...