Malicious Package

Overview chai-as-bench is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in chai-as-bench (npm)

Source: amazon-inspector 487af469d8de2a3caa5e798df3a5d56e59b795c1ddc106abd1d38ed855b6fb17 The package presents itself as a chai plugin name resembles chai-as-promised, manifest description references chai assertions, but ships no chai-related functionality. index.js unconditionally loads...

MAL-2026-13699 Malicious code in chai-as-bench (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 487af469d8de2a3caa5e798df3a5d56e59b795c1ddc106abd1d38ed855b6fb17 The package presents itself as a chai plugin name resembles chai-as-promised, manifest description references chai assertions, but ships no...

Memoir: Learning, Verifying, and Evolving False-Positive Memories for Static Application Security Testing Tools

Static Application Security Testing SAST tools have become indispensable in modern secure software devel- opment. However, these tools often generate false-positive FP alerts, imposing substantial manual inspection costs and reducing the trust from developers. Existing FP reduction methods still...

CVE-2026-70639 llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639 llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

kube-bench v0.16.0

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Tests are configured with YAML files, making this tool easy to update as test specifications evolve. CIS Scanning as part of Trivy and the Trivy Operator Triv...

Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments

Coding agents increasingly run inside organizations whose security controls scoped credentials, restricted egress, read-only filesystems, non-root execution constrain them like any other software. Existing benchmarks, however, evaluate agents almost exclusively in permissive sandboxes, so it is...

AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair

Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general b...

CLEANSTART-2026-SY46985 Security fixes in kube-bench 0.15.0-r0

Package kube-bench version 0.15.0-r0 fixes 3 vulnerabilities: CVE-2026-35469, CVE-2026-33815, CVE-2026-33816...

CLEANSTART-2026-HC35488 Security fixes in kube-bench-fips 0.14.1-r0

Package kube-bench-fips version 0.14.1-r0 fixes 4 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730...

CLEANSTART-2026-VV16787 Security fixes in kube-bench 0.15.0-r1

Package kube-bench version 0.15.0-r1 fixes 23 vulnerabilities: CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506, CVE-2026-25680...

HoF-Bench: Rediscovering Real AI-Discovered CVEs without Frontier Models

AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS. They introduce HoF-Bench named after AISLE's public Hall of Fame, a benchmark built from 95 of these public AI-discovered CVEs across eight repositories pinned at vulnerable commits...

CryptanalysisBench: Can LLMs Do Cryptanalysis?

Cryptanalysis - the task of finding attacks against cryptographic schemes - sits at the intersection of mathematical reasoning and cybersecurity, two areas where LLMs have advanced fastest. Cryptanalysis represents both a clean testbed for frontier reasoning as practical attacks can be...

DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection

Large language models LLMs are increasingly applied to vulnerability detection due to their strong code comprehension capabilities, but most existing approaches rely on isolated functions or context extracted by fixed program-analysis rules. These methods cannot adaptively explore repository-leve...

aider-chat (>=0.82.3, <=0.85.2), aider-code (>=0.1.0.dev19, <=0.1.1.post14) +186 more potentially affected by CVE-2026-59197 via pillow (11.2.1)

pillow PYPI version 11.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aider-chat =0.82.3, =0.1.0.dev19, =0.0.1, =3.1.20260611, =0.1.0, =0.2.0, =0.1.0, =2026.5.28, =2026.4.15, =2.0.6, =25.5.0, =0.0.0, =1.4.3, =0.5.0b2,...

airflow-parse-bench (>=0.0.1, <=1.0.1), dkist-processing-common (>=10.5.6rc1, <=10.5.14) +7 more potentially affected by CVE-2026-40690 via apache-airflow (2.10.4)

apache-airflow PYPI version 2.10.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-parse-bench =0.0.1, =10.5.6rc1, =4.3.0, =1.4.10, =0.20.1, =1.6.27, =1.23.7rc1, =1.18.7, =2.20.9, =2.20.19 Source cves:...

airflow-parse-bench (>=0.0.1, <=1.0.1), apache-airflow-providers-common-compat (>=1.0.0, <=1.5.1) potentially affected by CVE-2025-69219 via apache-airflow-providers-http (5.4.0)

apache-airflow-providers-http PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-http and may be impacted: - airflow-parse-bench =0.0.1, =1.0.0, =1.5.1 Source cves: CVE-2025-69219 Source advisory:...

Antiproof: Synthesizing Vulnerability Detectors and Proofs of Exploitability

Discovering vulnerabilities before attackers exploit them requires high recall and reliable automatic validation, but existing approaches struggle to achieve both without prohibitive cost. We present Antiproof, an end-to-end vulnerability discovery system that combines neuro-symbolic detector...