CVE-2026-109394

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

EUVD-2026-97492

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

peirates

Peirates ¿Qué es Peirates? Peirates, una herramienta de penetración para Kubernetes, permite a un atacante escalar privilegios y pivotar a través de un clúster de Kubernetes. Automatiza técnicas conocidas para robar y recolectar tokens de cuentas de servicio, secretos, obtener ejecución de código...

CVE-2026-109394: Authorization Bypass Through User-Controlled Key

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

Malicious code in @hrmony/kit-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a4084c44ab6554d66c474338de2cb482a25b31e6822d470e08b2b2ef5b1735a The package executes credential-harvesting code both from its postinstall script scripts/check-setup.mjs and from its main entry index.js, so theft...

MAL-2026-17266 Malicious code in @hrmony/kit-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...

Malicious code in @hrmony/kit-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...

MAL-2026-17253 Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

MAL-2026-17254 Malicious code in @hrmony/benefit-internetzuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209d5855ea7b92261c91e4f405f0306f268bb92b9ca8f888bfec4d0a84053544 On module import, the package unconditionally beacons to the hardcoded external host...

Malicious code in @hrmony/benefit-internetzuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209d5855ea7b92261c91e4f405f0306f268bb92b9ca8f888bfec4d0a84053544 On module import, the package unconditionally beacons to the hardcoded external host...

MAL-2026-17258 Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

Malicious code in @hrmony/organisationsverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78807365ee9728923ec2d5d103ce7f4562b21e2fc8185483b482bb5d2f79748d @hrmony/organisationsverwaltung 7.99.0 executes credential-theft code at the top level of index.js, so simply requiring or importing the package...

MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

MAL-2026-17279 Malicious code in @hrmony/pladddform-shared-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89319d39ad6d753459be90c221d657a73f70955c63d1675b347c11b5743209cc On module import, index.js executes three exfiltration routines that POST harvested secrets to the hardcoded endpoint...

Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

MAL-2026-17260 Malicious code in @hrmony/devtool-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cb569df9c47639ee0fd16c34a4ac1b97b89733b1b468389d8032087ab233b On import, index.js performs an unconditional POST beacon to https://hrnmn.dd.h4x.tv/saveinstanceinfofrompkgehrmonydevtool-configuration, then querie...