Malware in @lumen-labs-dev/whisper-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @lumen-labs-dev/whisper-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9643145fda005627c853ce885fce2cba3f7c4ad008b8e3925fc2639b270567b The package was scanned and no a static rule matches or traced behaviors indicating supply-chain attack patterns were observed. No lifecycle scripts...

MAL-2026-18194 Malicious code in @lumen-labs-dev/whisper-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9643145fda005627c853ce885fce2cba3f7c4ad008b8e3925fc2639b270567b The package was scanned and no a static rule matches or traced behaviors indicating supply-chain attack patterns were observed. No lifecycle scripts...

Malicious Package

Overview @lumen-labs-dev/whisper-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-110640

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110640

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110640

The whisper-node library (through version 1.1.1 ) is vulnerable to an OS command injection vulnerability in the whisper() function. The root cause is the improper neutralization of special elements within the command string built by createCppCommand() . Attackers can provide crafted filePath or w...

EUVD-2026-101268

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

PT-2026-114082

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110640: Improper Neutralization of Special Elements used in an OS Command

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...