Malicious code in thirdwb (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. thirdwb is a typosquat of the legitimate thirdweb package. It uses a side-loader technique, pulling in log-taker as a transitive dependency; the infostealer runs automatically via that dependency's...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.118), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +11 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.118)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =8.0.0, =10.1.0 Source cves: CVE-2026-55276 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734714...

be.dabla:grizzly-spring-boot-jasper (>=2.0, <=2.7), co.cask.tephra:tephra-examples (>=0.6.2, <=0.7.1) +360 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat-util (>=9.0.0.m1, <=9.0.118)

org.apache.tomcat:tomcat-util MAVEN version =9.0.0.m1, =2.0, =0.6.2, =0.6.0, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =2.0.0, =5.9.6, =1.10, =1.10, =2.6.0, =2.8.0 - com.codedx:webapp-runner 9.0.65.0 - com.codedx:webapp-runner-main 9.0.65.0 - com.codedx:webapp-runner-memcached 9.0.65....

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), codes.vps:tomcat-valve-request-filter (1.0) +161 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat-util (>=10.1.0-m1, <=10.1.55)

org.apache.tomcat:tomcat-util MAVEN version =10.1.0-m1, =2.0.7, =4.0.0, =5.0.0-m1, =5.0.0-m4, =1.0.0, =3.0.0, =5.0.0, =5.0.0, =3.3.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.55.0 and more Source cves: CVE-2026-55276 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734713...

ai.astraform:remote-domain-template-java-spring (0.2.0), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2815 more potentially affected by CVE-2026-53434 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.22)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-53434 Source advisory:...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3), @cowprotocol/cms (0.1.0-rc.5) +33 more potentially affected by CVE-2026-57997 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=5.42.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.1.1, =0.0.1, =0.1.0, =1.0.10, =4.3.15 and more Source cves: CVE-2026-57997 Source advisory: SNYK:JS-STRAPIPLUGINUSERSPERMISSIONS-17706022...

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), codes.vps:tomcat-valve-request-filter (1.0) +117 more potentially affected by CVE-2026-55956 via org.apache.tomcat:tomcat-catalina (>=10.1.0, <=10.1.55)

org.apache.tomcat:tomcat-catalina MAVEN version =10.1.0, =2.0.7, =1.0.0, =5.0.0, =5.0.0, =3.3.0, =0.2.0, =20260429, =20260429, =2.8.0, =0.2.2, =0.2.4 and more Source cves: CVE-2026-55956 Source advisory: MEND:CVE-2026-55956...

com.navercorp.pinpoint:pinpoint-batch (>=2.3.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-flink (>=2.3.0, <=3.0.5) +6 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-web (>=2.3.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-web MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =3.0.0, =3.0.0, =2.5.0, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755931...

com.navercorp.pinpoint:pinpoint-batch (3.1.0), com.navercorp.pinpoint:pinpoint-hbase2-web (>=2.5.1-p1, <=2.5.4) +3 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-basic-login (>=2.5.1, <=3.1.0)

com.navercorp.pinpoint:pinpoint-basic-login MAVEN version =2.5.1, =2.5.1-p1, =3.0.0, =2.5.1, =2.5.1, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755930...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-batch-alarmsender (>=3.0.0, <=3.1.0) +5 more potentially affected by CVE-2026-57947 via com.navercorp.pinpoint:pinpoint-webhook (>=3.0.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-webhook MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 Source cves: CVE-2026-57947 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755929...

com.github.manosbatsis.kmm.converters:kmm-converters-elide-starter (1.0.0-alpha.2), com.github.manosbatsis.kmp.converters:kmp-converters-elide-starter (>=1.0.0-alpha.3, <=1.0.0-alpha.8) +19 more potentially affected by CVE-2026-57954 via com.yahoo.elide:elide-graphql (>=4.0-beta-2, <=7.2.0)

com.yahoo.elide:elide-graphql MAVEN version =4.0-beta-2, =1.0.0-alpha.3, =5.0.0, =5.0.0, =6.0.0, =4.7.2, =7.0.3, =7.0.3, =4.5.7, =4.0-beta-4, =1.0.17, =1.14.0, =0.2.0, =2.5.0 and more Source cves: CVE-2026-57954 Source advisory: SNYK:JAVA-COMYAHOOELIDE-17755934...

com.github.manosbatsis.kmm.converters:kmm-converters-elide (1.0.0-alpha.2), com.github.manosbatsis.kmm.converters:kmm-converters-elide-autoconfigure (1.0.0-alpha.2) +42 more potentially affected by CVE-2026-57954 via com.yahoo.elide:elide-core (>=1.0.0.1, <=7.2.0)

com.yahoo.elide:elide-core MAVEN version =1.0.0.1, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.0.0-alpha.3, =0.0.1, =2.3.0, =5.0.0, =5.0.0, =1.0.0.8, =1.0.0.6, =5.1.2 and more Source cves: CVE-2026-57954 Source advisory: SNYK:JAVA-COMYAHOOELIDE-17755935...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +2830 more potentially affected by CVE-2026-13676 via fast-uri (>=2.4.7, <=3.1.2)

fast-uri NPM version =2.4.7, =1.0.0, =1.0.5, =1.0.3, =0.5.2-alpha-20231022145212-c0afe8d, =0.1.4-alpha-20231022145212-c0afe8d, =0.1.4-alpha-20231022145212-c0afe8d, =0.6.0, =0.2.0, =0.2.0, =0.0.1-alpha-20240310235646-1ea207b758e2c4cacf2c0f592448d86a94ff5ba4, =0.3.1, =0.3.4 - @adbl/cartridge...

@bsklaroff/yaac (>=0.0.1, <=0.0.6), @chude/memory (4.0.0) +14 more potentially affected by CVE-2026-55607 via @anthropic-ai/claude-code (>=2.1.39, <=2.1.154)

@anthropic-ai/claude-code NPM version =2.1.39, =0.0.1, =0.7.5, =0.6.0-beta.3, =1.30.1-broken.0, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =0.0.2, =0.0.4 - feishu-claude-bot 0.1.0 - hkclaw-lite 1.0.1 and more Source cves: CVE-2026-55607 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-17817924...

acadrust (>=0.3.1, <=0.6.5), acir (>=0.44.0, <=0.46.0) +1882 more potentially affected by unknown CVE via quick-xml (>=0.1.9, <=0.40.1)

quick-xml CARGO version =0.1.9, =0.3.1, =0.44.0, =0.1.0, =0.2.0, =0.4.0, =0.2.0, =0.3.1, =0.4.2, =0.1.1, =0.1.0, =0.7.0, =0.1.0, =0.1.1 - airgorah 0.1.0 - airocore 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0195...

acadrust (>=0.3.1, <=0.6.5), acir (>=0.44.0, <=0.46.0) +1882 more potentially affected by unknown CVE via quick-xml (>=0.1.9, <=0.40.1)

quick-xml CARGO version =0.1.9, =0.3.1, =0.44.0, =0.1.0, =0.2.0, =0.4.0, =0.2.0, =0.3.1, =0.4.2, =0.1.1, =0.1.0, =0.7.0, =0.1.0, =0.1.1 - airgorah 0.1.0 - airocore 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0194...

a2 (>=0.1.0, <=0.3.17), arcor2-calibration (0.8.0) +100 more potentially affected by CVE-2026-44727 via jupyter-server (>=2.0.0rc3, <=2.17.0)

jupyter-server PYPI version =2.0.0rc3, =0.1.0, =0.1.0, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.3.5, =0.3.8 - controlman 0.0.0.dev340 - counterplots 0.0.9 and more Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

asiva (>=1.0.1, <=1.3.1), jupyterlab-daisy (>=1.0.6, <=1.0.9) potentially affected by CVE-2026-44727 via jupyter-server (1.8.0)

jupyter-server PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - asiva =1.0.1, =1.0.6, =1.0.9 Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

image-crawl (0.1.0), vimms (2.0.1) +1 more potentially affected by CVE-2026-44727 via jupyter-server (1.10.2)

jupyter-server PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - image-crawl 0.1.0 - vimms 2.0.1 - xircuits =1.0.0, =1.2.0 Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=1.1.1rc4), aepsych (>=0.3.0, <=0.4.0) +202 more potentially affected by CVE-2026-44727 via jupyter-server (1.24.0)

jupyter-server PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - acryl-datahub-gx-plugin =0.14.0.3rc1, =0.3.0, =0.1.0b0, =0.1.0, =0.2.2, =0.0.2, =0.0.2, =0.1.0, =0.2.0, =0.3.0 -...