MAL-2026-10318 Malicious code in ishowfeet16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37f59327c1b69e899f78c8fdaf7d1b33c2760608adda627306fbac6537257d21 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10309 Malicious code in imillegal4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e410fdca18f0aedc18130966449a52dce6ecc481c6d8c7b823764f09146d625 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10368 Malicious code in ratelimitsucks3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a45b50938677bb4c4bcdeee48af3fd57a8204d48d6aff16a1351ae814491391 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10325 Malicious code in ishowfeet4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8772abfff8be97e21dacda47b1a535bea90b6793740846a30308d75c3b2f655b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10371 Malicious code in ratelimitsucks9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c5a4a441bf00f2d9dd64e778e4c796779d0a4a216b92bcaee66d8012d4ce255 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10365 Malicious code in ratelimitsucks1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908fa35f3ab37dd9e5b137580117e8be746c328b74934d3a5f04d8ce805149b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10366 Malicious code in ratelimitsucks10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ea43317a905d4e9b4a22dac3a0e325d92493557c5dc6b376f2e05d84d2fb29a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10314 Malicious code in ishowfeet12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60cb6a8169d535b5e52d5fa3cb7a1a16bf4f2d15f87d894a4111da9b74fedae The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10313 Malicious code in ishowfeet11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35ad3f426377de0f1898ef51d148062669bd91d3cbae08ffe620af8514fde41e The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10312 Malicious code in ishowfeet10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4148b124e7ddd86ab1dd66865b0dad79d42d666a36a5e122f07e12b0d3029570 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10311 Malicious code in ishowfeet1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49cfb64273573166bc38b5ef83b722b3a264c8e19870fc65b35eaaa5504a69bf The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10322 Malicious code in ishowfeet2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33cbeb0130c1ef8842cc7d912f9d12b756efd200949266a3232a83cbfd2cdce4 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10292 Malicious code in backupsitetuff3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8a9cdadf95e8850030fa5609c47ad2873664ce1001973cd8edf34176d4a779 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10329 Malicious code in ishowfeet8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f84766a048383d03dee0415d1cada0c19a19afd27efb5a76217e7333bed084 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ratelimitsucks6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbee718bfa55eada8a2d56c9ea228e7b661364827e71995fd456027df7eedb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-6136 Malicious code in ratelimitsucks6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbee718bfa55eada8a2d56c9ea228e7b661364827e71995fd456027df7eedb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

CVE-2026-42431

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invokebrowser.proxy that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations...

CVE-2026-42431 OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invokebrowser.proxy that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations...

EUVD-2026-26133

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invokebrowser.proxy that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations...

CVE-2026-42431

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invokebrowser.proxy that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations...