CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

Malicious code in base-account-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae6343291a1e909323f40cb39c63de633e733d3a7ca24827d35ff2d960f9e6a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MSC-2026-11586

Shai-Hulud npm supply chain attack resurfaces after 111 days dormant. The same malicious payload SHA-256 e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 that compromised 319 package versions in the May 19, 2026 @AntV incident was republished on npm across four packages, beaconing...

Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain

AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: softwar...

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a vulnerable dependen...

TrojanWorld: Backdooring World-Model Agents Via Imagination Steering

World models increasingly serve as the predictive core of model-based reinforcement learning agents, enabling them to simulate future dynamics and reason over imagined trajectories before acting. Their substantial training demands make pretrained world models attractive for distribution and reuse...

Malicious code in dolyame-ui-test (npm)

Source: amazon-inspector 8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d index.js unconditionally requires./platform on module load. platform.js reconstructs attacker-controlled hostnames via string-splitting Array.join to fetch a platform-specific native binary from one of four...

Malicious code in dolyame-ui-tag (npm)

Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from split string fragments oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-notification (npm)

Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four obfuscated Cloudflare workers.dev hosts...

Malicious code in dolyame-ui-confirmation (npm)

Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture, downloads a native binary from one of three Cloudflare Worke...

Malicious code in dolyame-ui-colors (npm)

Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binary dropper. shim.js selects a platform-specific endpoint an...

Embedded Malicious Code

Overview feishu-docx-mcp is a Model Context Protocol server for Feishu integration Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published...

Embedded Malicious Code

Overview bmc-translate-utils is a 翻译工具函数，支持有道，谷歌，百度，阿里机器、openAI翻译 Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published tampered version...

Embedded Malicious Code

Overview blueai-cli is a BlueAI atomic capabilities CLI Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published tampered versions to the n...

Embedded Malicious Code

Overview bmc-i18n-extract-cli is a 这是一款能够自动将代码里的中文转成i18n国际化标记的命令行工具。当然，你也可以用它实现将中文语言包自动翻译成其他语言。适用于vue2、vue3和react Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by...

MAL-2026-15960 Malicious code in @liuliang520500/sinataoke_cn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e3ff1d04feca3fcec866427a6d90307e3391fde1e732c8f600a06e86900af5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @liuliang520500/taobao-topclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fce1760178d3d6c27bfbeac47e726c22a17252d491a2988939082c1ead4a4ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dcftunnel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 884e82f2b3a290f58a48f1b1527c1b3c0494447390ab9c31f4f82544040e5709 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15969 Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...