400 matches found
MAL-2026-12461 Malicious code in streak-daily-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...
MAL-2026-12460 Malicious code in streak-count-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa [email protected]'s index.mjs executes a hex-obfuscated routine on module import gated only by NODEENV!== 'production'. When it detects a WSL...
Malicious code in streak-count-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa [email protected]'s index.mjs executes a hex-obfuscated routine on module import gated only by NODEENV!== 'production'. When it detects a WSL...
Malicious code in streak-day-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch,...
Malicious code in korvica (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...
MAL-2026-11139 Malicious code in kordyn (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c379ec39ec7791c9128dc4e1b82199ce29d7540a9a9984036af2ac79de38e1bf [email protected] advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities 'Early release — placeholder...
Malicious code in streak-daily-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...
CVE-2026-63833
A flaw was found in the Linux kernel's ntfs3 filesystem driver. An unprivileged local user with write access to an ntfs3 mounted filesystem can exploit a vulnerability by directly modifying internal Windows Subsystem for Linux WSL permission metadata. This manipulation allows the user to gain roo...
CVE-2026-63833
The CVE-2026-63833 issue affects the Linux kernel ntfs3 module: an unprivileged user on a writable NTFS3 mount could abuse the empty-prefix xattr handler to write to reserved $LX* attributes, enabling planting root ownership and S_ISUID on their file and obtaining effective user ID 0 after inode ...
CVE-2026-63833 ntfs3: reject direct userspace writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into iuid, igid and imode from ntfsgetwslperm. Because the empty-prefi...
EUVD-2026-43904
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally...
CVE-2026-57968
Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...
CVE-2026-57973
Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally...
CVE-2026-57968
Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...
CVE-2026-57973
Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally...
CVE-2026-57973 Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
...
CVE-2026-57973 Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
...
EUVD-2026-44280
Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally...
CVE-2026-57973
CVE-2026-57973 describes a Time-of-check Time-of-use (TOCTOU) race condition in Windows Subsystem for Linux (WSL2) kernel. The issue allows an authorized attacker to perform local tampering. Affected component is the WSL2 kernel; impact per sources is local, with confidentiality and integrity aff...