Malicious code in @galicia-toolkit-nestjs/commons (npm)

Source: amazon-inspector eae27acb3901d275439e482d51a1451df67c1a6b2011f35881253a3fa8d2456b The package ships a tiny index.js that requires a bundled ELF at prebuilds/linux-x64/metrics.node inside a swallow-all try/catch on module load. No C/C++ source, binding.gyp, or node-gyp/prebuild tooling is...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

Source: amazon-inspector 605d8d8afe172d78840f3617c35733b47635a3482beba461bc1015c45840e250 The package presents itself as a NestJS Swagger integration name resembles @nestjs/swagger, published at version 999.0.2 in a dependency-confusion shape but ships a stub JavaScript API forRoot/createLogger...

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

Source: amazon-inspector ffdc9c111498bf0f75d014ef58b811df488c9014addfb1ed64f7ab28cf9c11b1 On require'@galicia-toolkit-nestjs-20/paas', index.js unconditionally loads prebuilds/-/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @galicia-toolkit-nestjs-20/commons (npm)

Source: amazon-inspector 5b719740efc4b3e93e85668e2e787b39a8d91e15abbe9c39f5d156e118745caa On require, index.js loads a bundled ELF native addon at prebuilds/linux-x64/metrics.node inside a silent try/catch. The addon reads CI/cloud credential environment variables AWSSECRETACCESSKEY and related...

Malicious code in @brick-v2/core (npm)

Source: amazon-inspector 90c1fd9505ce4256620f9cb647e3a57a5af52539aa1e717a3eecb0485dec8c83 The package's main entry index.js loads a prebuilt native binary at prebuilds/-/metrics.node inside a top-level try/catch, executing native code within the Node process as soon as the module is required. The...

Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)

Source: amazon-inspector 9974df3d2695630f5921c98037f0359ed3948cc0afd0c13d4ad5043819950f15 package.json declares a preinstall hook node index.js || true, which require's a bundled native addon at prebuilds/-/metrics.node. On N-API registration the addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @brick-v2/icons (npm)

Source: amazon-inspector 915977ddb276c313e2977875d853dfba4eebd12f75ad0826008866b5059c68a8 @brick-v2/[email protected] is a dependency-confusion credential stealer. The package's package.json declares a preinstall script node index.js, and index.js's only behavior is to require a platform-specific...

Malicious code in @brick-v2/tour (npm)

Source: amazon-inspector aabec40c085d56f59b4ca696eefe600f450a03284df0d77f562d861fed091bee The package presents itself as an Angular-style module exposing forRoot/createLogger stubs and a version field, but these exports are no-ops. The real behavior is in a bundled prebuilt native addon at...

Malicious code in @galicia-toolkit-cheques-nc/front (npm)

Source: amazon-inspector 29d819cdd288d1d18b8d76fbca2b2113941f344a5a80b2676ea5714367d8af44 Scoped npm package @galicia-toolkit-cheques-nc/front published at version 999.0.3 with UNLICENSED, no README, and no repository. package.json declares a preinstall hook node index.js || true, which loads a...

Malicious code in @brick-v2/brand (npm)

Source: amazon-inspector a194395a620ef40055a22d7beccbab1e1ca0c662afe83b9ee2fb23d07ebaedc5 package.json declares a preinstall hook node index.js || true that loads a prebuilt native addon at prebuilds/-/metrics.node. The addon reads credential-grade environment variables AWSSECRETACCESSKEY and oth...

Security Bulletin: Multiple vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were found in linux kernel, libssh expat, libssh, openSSL in Platform System Manager PSM OS Image for Red Hat Enterprise Linux v8 shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

MAL-2026-17710 Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

CVE-2026-106437

A flaw was found in mongo-c-driver. An attacker who can influence the buffer length supplied by an embedding application can trigger an integer underflow by passing an undersized value to the Binary JSON BSON buffer-reservation function. This issue leads to out-of-bounds memory reads and writes...

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 CVSS v4 score: 5.5 - An improper authentication...

sysmon-modular

sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...

Security Bulletin:Improper Handling of Exceptional Conditions in Erlang OTP erts (epmd)

Summary Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The doaccept function in erts/epmd/src/epmdsrv.c calls epmdcleanupexit wh...

CVE-2025-70330

🧩 CVE-2025-70330: Easy Grade Pro 4.1 File Parsing Vulnerability An educational example created to show beginners that vulnerability research through reverse engineering is possible from the very start. 📑 Table of Contents Why this repository exists Relation to "The Path That Leads to Your First...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE Research Lab Educational purposes only. Do NOT use on systems without explicit authorization. Index Description of the vulnerability Affected components How it works Lab setup Docker PoC — Demonstration Mitigation References Vulnerability Description...

CVE-2026-106432

A flaw was found in the MongoDB PHP Driver. In non-default runtime configurations permitting multi-gigabyte values, the BSON Binary JSON encoder converts large string lengths without validation, triggering an integer wrap and subsequent heap-based buffer overflow when encoding strings near four...