MAL-2026-13967 Malicious code in @hzero-front-ui/c7n-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 836c7ea4bdd57db38273e1e017c5a977d397cf321d36e5dbdd8060fbcd8ca08e Package @hzero-front-ui/[email protected] is an empty library whose only functional code runs in preinstall and install lifecycle hooks in package.json...

c7n-azure (0.7.10), c7n-openstack (0.1.1) +40 more potentially affected by CVE-2026-69248 via cryptography (3.4.6)

cryptography PYPI version 3.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - c7n-azure 0.7.10 - c7n-openstack 0.1.1 - combocurve-api-v1 =0.1.0, =2.0.0rc1, =0.1.6.1, =0.0.3, =0.1.0, =0.2.8, =0.5.0, =0.10.0, =1.0.0...

apputils-config (>=2.0.2.dev19, <=2.0.2.dev20), aws-gate (>=0.9.3, <=0.11.0) +43 more potentially affected by CVE-2026-69248 via cryptography (3.3.1)

cryptography PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.2.dev19, =0.9.3, =0.1.1, =1.1.0, =1.2.3, =3.26.0, =0.1.1, =21.1.0, =0.1.0, =0.0.1, =0.2.0, =0.2.8 and more Source...

c7n-azure (0.7.8), erpbrasil-assinatura (1.0.2) +2 more potentially affected by CVE-2026-69248 via cryptography (3.3.0)

cryptography PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - c7n-azure 0.7.8 - erpbrasil-assinatura 1.0.2 - myjwt 1.2.0 - swimlane-platform 10.6.0 Source cves: CVE-2026-69248 Source advisory:...

c7n-azure (0.7.8), erpbrasil-assinatura (1.0.2) +2 more potentially affected by CVE-2026-69249 via cryptography (3.3.0)

cryptography PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - c7n-azure 0.7.8 - erpbrasil-assinatura 1.0.2 - myjwt 1.2.0 - swimlane-platform 10.6.0 Source cves: CVE-2026-69249 Source advisory:...

apputils-config (>=2.0.0, <=2.0.1.dev13), burstable (>=0.2.5rc2, <=0.2.6) +32 more potentially affected by CVE-2026-69249 via cryptography (3.0.0)

cryptography PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.0, =0.2.5rc2, =0.13.0, =3.16.0.dev2, =0.8.0, =0.0.1, =0.0.2, =11.0.0b3, =0.1.2, =1.0.0, =0.1.9, =0.1.12 and more...

azure-kusto-ingest (>=0.0.38, <=0.0.45), c7n-azure (>=0.7.0, <=0.7.9) +2 more potentially affected by CVE-2022-30187 via azure-storage-queue (2.1.0)

azure-storage-queue PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-queue and may be impacted: - azure-kusto-ingest =0.0.38, =0.7.0, =0.0.1, =0.0.4 - npyetl 0.0.5 Source cves: CVE-2022-30187 Source advisory:...

c7n-azure (>=0.7.18, <=0.7.19), c7n-kube (>=0.2.18, <=0.2.19) +6 more potentially affected by CVE-2026-59890 via setuptools (65.4.1)

setuptools PYPI version 65.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - c7n-azure =0.7.18, =0.2.18, =0.1.0, =1.9.0, =1.10.0 - shaystack 0.10.0 - stapy 0.3.1 Source cves: CVE-2026-59890 Source advisory:...

c7n-azure (>=0.7.24, <=0.7.25), c7n-kube (>=0.2.24, <=0.2.25) +24 more potentially affected by CVE-2026-59890 via setuptools (67.6.1)

setuptools PYPI version 67.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - c7n-azure =0.7.24, =0.2.24, =0.6.24, =0.0.88, =0.0.1, =1.0.0b2, =4.7.0, =0.0.31, =0.0.28, =0.0.115, =0.0.5, =0.0.6, =2.0.0a1, =2.0.0a2 and...

c7n-azure (0.7.22), c7n-kube (0.2.22) +1 more potentially affected by CVE-2026-59890 via setuptools (67.3.2)

setuptools PYPI version 67.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - c7n-azure 0.7.22 - c7n-kube 0.2.22 - c7n-sphinxext 1.1.22 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

airgym (>=0.0.1, <=0.0.2), c7n-gcp (>=0.4.24, <=0.4.25) +20 more potentially affected by CVE-2026-0994 via protobuf (4.22.1)

protobuf PYPI version 4.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - airgym =0.0.1, =0.4.24, =0.6.24, =2.3.3, =0.0.1, =4.7.0, =0.0.3, =0.0.3, =0.3.5, =0.0.13, =0.0.18 - podloot 0.1.0 and more Source cves:...

ai-flow (0.3.1), ai-flow-nightly (>=2022.9.19, <=2023.12.31) +19 more potentially affected by CVE-2026-0994 via protobuf (3.15.6)

protobuf PYPI version 3.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ai-flow 0.3.1 - ai-flow-nightly =2022.9.19, =0.1.0.2, =3.0.8rc6, =1.0.9, =0.0.1, =1.17.0b1, =1.14.0, =0.3.1, =0.3.73, =0.1.0, =2022.9.19,...

c7n-gcp (0.4.2), ciphey (3.5.7) +28 more potentially affected by CVE-2026-0994 via protobuf (3.12.2)

protobuf PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.2 - ciphey 3.5.7 - custos-sdk 1.0.2 - dagit =0.8.6rc1, =0.8.6rc1, =0.8.6rc1, =0.2.24, =0.1.12, =0.0.0, =1.15.0b1, =0.3.0, =0.3.1,...

c7n-gcp (0.4.26), robotframework-browser (16.2.0) potentially affected by CVE-2026-0994 via protobuf (4.23.1)

protobuf PYPI version 4.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.26 - robotframework-browser 16.2.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

bsk (2.8.33), bts-mlb (0.1.2) +41 more potentially affected by CVE-2025-4565 via protobuf (>=6.30.0, <=6.31.0)

protobuf PYPI version =6.30.0, =1.0.0, =4.0.7, =0.2.0b3, =1.0.1, =1.0.0, =1.10.0rc3, =0.0.0, =1.0.0rc1, =1.1.1 - isosegdenoise 0.1.2.dev310 and more Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

arize (>=1.0.4, <=2.1.11), c7n-gcp (0.4.1) +1 more potentially affected by CVE-2025-4565 via protobuf (3.12.0)

protobuf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - arize =1.0.4, =2.1.11 - c7n-gcp 0.4.1 - wirepas-mesh-messaging 1.2.0 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

adversarial-insight-ml (0.1.0), aibench (>=0.0.2, <=0.0.5) +95 more potentially affected by CVE-2024-6345 via setuptools (68.0.0)

setuptools PYPI version 68.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - adversarial-insight-ml 0.1.0 - aibench =0.0.2, =0.0.5.dev0, =0.1.18, =2.1.0, =1.22.0a0, =1.0.0, =0.7.27, =0.1.0, =7.0.0, =0.1.28, =0.1.29 a...

adaptgym (>=0.1.1, <=0.1.2), aiearth-engine (>=3.1.0, <=3.1.5) +34 more potentially affected by CVE-2024-6345 via setuptools (66.0.0)

setuptools PYPI version 66.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - adaptgym =0.1.1, =3.1.0, =0.2.2, =0.1.1, =0.2.2 - bob-bio-base 8.0.0 - bob-bio-face 8.0.0 - bob-bio-spear 5.0.0 - bob-bio-vein 5.0.0 -...

c7n-azure (0.7.22), c7n-kube (0.2.22) +1 more potentially affected by CVE-2024-6345 via setuptools (67.3.2)

setuptools PYPI version 67.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - c7n-azure 0.7.22 - c7n-kube 0.2.22 - c7n-sphinxext 1.1.22 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

c7n-azure (0.7.8), erpbrasil-assinatura (1.0.2) +2 more potentially affected by CVE-2023-50782 via cryptography (3.3.0)

cryptography PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - c7n-azure 0.7.8 - erpbrasil-assinatura 1.0.2 - myjwt 1.2.0 - swimlane-platform 10.6.0 Source cves: CVE-2023-50782 Source advisory:...