Malicious code in cursed-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...

MAL-2026-6674 Malicious code in ripshakti1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 764edbf390c427ef99a9d9164034b966fbac251f00240bbb219825c0c92422a6 package.json declares a preinstall lifecycle hook node index.js that auto-executes on npm install. index.js queries the AWS EC2 instance metadata...

Malicious code in ts-bn-proto (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. ts-bn-proto embeds an infostealer payload directly in index.js with a base64-encoded C2 address data-stream.space, executed at install time via a postinstall hook. The payload harvests cryptocurrency wallet...

MAL-2026-6692 Malicious code in polymarket-trading-developer-tools (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...

Malicious code in log-taker1 (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. log-taker1 embeds a full infostealer 2800 lines directly in index.js, executed at install time via postinstall: node test.js. The payload harvests cryptocurrency wallet vaults MetaMask, Phantom, Solflare,...

CVE-2026-13316: Server-Side Request Forgery (SSRF)

A flaw has been found in foreman when HTTP parameters are modified in httpproxiescontroller and httpproxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component...

MAL-2026-6691 Malicious code in polymarket-clob-maths (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-clob-maths uses a dropper technique: a postinstall hook fetches a remote bundle from trabalhos-flax.vercel.app and executes a syncSession function that runs a...

PYSEC-2026-384 Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...

PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

CVE-2026-13763: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This iss...

CVE-2026-13762: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:2643-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2643-1 advisory. This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385:...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: policy-controller, tkn-fips, kubescape-server-fips, kyverno, neuvector-sigstore-interface-fips, zarf, ko, ratify, aactl, crossplane, slsa-verifier, teleport, spire-server-fips, tekton-chains-fips, neuvector-sigstore-interface, ko-fips, commercial-kyverno, tflint-fips...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: policy-controller, tkn-fips, kubescape-server-fips, kyverno, neuvector-sigstore-interface-fips, zarf, ko, ratify, aactl, crossplane, slsa-verifier, teleport, spire-server-fips, tekton-chains-fips, neuvector-sigstore-interface, ko-fips, commercial-kyverno, tflint-fips...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: zitadel, kubescape-server-fips, opentelemetry-collector, external-secrets-operator-fips, etcd-fips, aactl, nerdctl, frankenphp-8.5, flux-source-controller-fips, frankenphp-8.4, knative-kafka-broker-fips, kots, kube-conformance, traefik, kyverno-fips, coder,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: zitadel, kubescape-server-fips, longhorn-cli, crossplane-provider-aws-rds, packer-fips, etcd-fips, crossplane-provider-aws-ecr, chainloop-control-plane-fips, crossplane-provider-aws-elb-fips, crossplane-provider-aws-rolesanywhere-fips, longhorn-manager, frankenphp-8....

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: mods, datadog-agent, kine, apko, age, steampipe, docker-machine-driver-harvester, step-kms-plugin, step, eksctl, pulumi-language-java, policy-controller, gitlab-runner, syft, atlantis, crossplane-provider-azure-authorization, witness, chezmoi, step-issuer, flux,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux-source-controller, flux-image-automation-controller, skaffold, kine, trivy, external-secrets-operator, cilium-cli, loki, osv-scanner, cilium, kyverno, argocd-image-updater, cert-manager, falco-no-driver, chisel, gitea, mattermost, minio, istio, telegraf,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: kine, apko, docker-machine-driver-harvester, step-kms-plugin, step, pulumi-language-java, syft, witness, chezmoi, step-issuer, flux, wolfictl, flux-source-controller, dagger, flux-image-automation-controller, go-discover, trivy, cilium-cli, loki, nuclei, mattermost,...