SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

Summary validateCertificatePath does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds which could be user-supplied, and exits early. This happens before the configured...

GHSA-6HXQ-P678-4HR2 SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

Summary validateCertificatePath does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds which could be user-supplied, and exits early. This happens before the configured...

MAL-2026-15946 Malicious code in @crysnovax/plug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b242d3d1fc217775fa550cf39213eba711b3fd758f5ac0f077a3a33af631eed9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @crysnovax/plug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b242d3d1fc217775fa550cf39213eba711b3fd758f5ac0f077a3a33af631eed9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found many sites hosted both an llms.txt...

Malicious code in claims-format-money (npm)

Source: amazon-inspector bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009 The package's index.js requires bootstrap.js on import. bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments assembling oob-worker.cf-.workers.dev hosts with DNS TXT...

Malicious code in checkout-input-card-logic (npm)

Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains oob-worker.cf.workers.dev, hostnames assembled at runtime by joining string...

Malicious code in chain-promised (npm)

Source: amazon-inspector 2fd6ee3247632a88a25b8059314727f1757ed1163081b133945fbe4af59e5d28 The package chain-promised was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-xor (npm)

The package chain-xor was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-multer (npm)

Source: amazon-inspector 53cc34f0f3bb0c4829ea6a271ba921ebdd97ea8272285dbc159f5ede247d27ff The package chain-multer was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-syncora (npm)

Source: amazon-inspector c6d15e07fe0ec278f0437e4e651444bca1fa0cfac0f3cb50e06224e2fa3fde45 The package chain-syncora was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-promised-async (npm)

Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-cli-promised (npm)

Source: amazon-inspector 8f7e399daf13fda688fc1a6bb911c0bf7582ef52fff3eb5af58fbd8c0934b88a The package chain-cli-promised was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-argon (npm)

Source: amazon-inspector 12ee1203bf0112eb0f499bffaaaaa84264b875f83e282b54ec6749fe9230baf2 The package chain-argon was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-metrica (npm)

Source: amazon-inspector fb624dbdf0ad26818c6d6685e22838c8bbb23d223376ba009f53500ca469ad86 The package chain-metrica was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chain-promised-cli (npm)

Source: amazon-inspector 905259914ab893ce8ca6d455af186ca553bb76d253657ea9f38457798519c708 The package chain-promised-cli was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chai-promise-chain (npm)

Source: amazon-inspector a4ecbe8f1fc2ecc76ad2c336265b5750a854b1e0cf54067d357cd5638ad5c501 The package chai-promise-chain was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chai-chain-argon (npm)

Source: amazon-inspector 843de6d2665a1833194793cfe05d91e35574e922fbb24cc0879c32352189a29c The package chai-chain-argon was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chai-chain-cognivault (npm)

Source: amazon-inspector 19b0851e6e0e1c6814315a7876df23ebeb1c80c5afd8093f9790c0b2fb6ba605 The package chai-chain-cognivault was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in chai-chai-chain-promised (npm)

Source: amazon-inspector 05be57049f1ed27fc157d4893925be0d06323a7b47e8b8893ff0c353e5ddb82d The package chai-chai-chain-promised was found to contain malicious code. --- Credit: OpenSSF source...