Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

Source: amazon-inspector ffdc9c111498bf0f75d014ef58b811df488c9014addfb1ed64f7ab28cf9c11b1 On require'@galicia-toolkit-nestjs-20/paas', index.js unconditionally loads prebuilds/-/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

@galicia-toolkit-nestjs/swagger is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

CVE-2026-4035: Insertion of Sensitive Information Into Sent Data

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the apikey field in...