MAL-2026-12698 Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...

Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...

CVE-2026-48978

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978

A flaw was found in oras-go. The auth.Client in oras-go does not properly validate the scheme or host of the realm URL provided in a registry's WWW-Authenticate: Bearer challenge. A remote attacker, operating a malicious registry or performing a man-in-the-middle attack, could exploit this to...

MAL-2026-6263 Malicious code in gd-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de00613e21b42bf3c651995beae63ff9d85772b9370145152d172a062be4fb7 package.json declares preinstall: node index.js, which runs automatically on npm install. index.js requires os, dns, https, querystring, and the loca...

Malicious code in frontend-auth-client (npm)

The package frontend-auth-client was found to contain malicious code...

Malicious code in web-auth-client (npm)

The package web-auth-client was found to contain malicious code...

MAL-2025-20968 Malicious code in frontend-auth-client (npm)

The package frontend-auth-client was found to contain malicious code...

MAL-2025-38967 Malicious code in web-auth-client (npm)

The package web-auth-client was found to contain malicious code...

MAL-2025-5971 Malicious code in vss-web-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70dc7c0837db09d1f3b1d98483b9ce346b56d8ea5ae46ee6b2d974d8be75ea26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-29036

Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users shoul...

MAL-2024-6722 Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...

@bundly/ic-core-js (>=0.1.0 <=0.4.2-rc.4), @bundly/ic-react (>=0.1.0 <=0.4.2-rc.4) +10 more potentially affected by CVE-2024-1631 via @dfinity/auth-client (>=0.20.2 <=0.9.3)

@dfinity/auth-client NPM version =0.20.2, =0.1.0, =0.1.0, =0.1.1, =0.0.2, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.0.38-next-2023-12-19, =0.0.1, =0.0.7 Source cves: CVE-2024-1631 Source advisory: OSV:GHSA-C9VV-FHGV-CJC3...

yii2 security vulnerabilities

yii2 is a fast, secure and professional PHP framework. A security vulnerability exists in yii2-authclient versions prior to 2.2.15 that stems from vulnerability to cross-site request forgery CSRF attacks...

MAL-2022-793 Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...