MAL-2026-15850 Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

Malicious code in @quantixfinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...

MAL-2026-15852 Malicious code in @quantixfinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...

MAL-2026-15851 Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

Malicious code in @quantixfinance/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in...

MAL-2026-15856 Malicious code in @quantixfinance/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in...

MAL-2026-15854 Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

Malicious code in @quantixfinance/supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings key, secre...

Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...

CVE-2021-43613

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

EUVD-2021-34868

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

CVE-2021-43613

A vulnerability in the SysPasswordDxe driver of Insyde InsydeH2O 5.x exposes user and administrator password hashes in runtime UEFI variables, enabling privilege escalation . The affected firmware is also used in Siemens SIMATIC industrial products. The CVSS 3.1 score is 6.5 (Medium) with a local...

Malicious code in company-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...

MAL-2026-15827 Malicious code in company-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...

Malicious code in telemetry-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname,...

PT-2026-84909

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

CVE-2021-43613: Incorrect Permission Assignment for Critical Resource

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...