Malicious code in @reducers/projects (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c280d6ec5724de44b3fafa7041f34d91e7896741e211cfc0419a1b84c6e241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14125 Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14127 Malicious code in @reducers/projects (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c280d6ec5724de44b3fafa7041f34d91e7896741e211cfc0419a1b84c6e241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-75911

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

Stolostron acm-operator-bundle software supply chain issue vulnerabilities

The Stolostron acm-operator-bundle has a software supply chain vulnerability. This vulnerability stems from the process of downloading scripts from remote sources during the build process, without verifying their authenticity and integrity. This could allow remote attackers to inject malicious...

MAL-2026-14126 Malicious code in @milleree/date-display (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2c195a06ca2577f279d5ec0939d9d958086f361f147e08b200c28786f776ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @milleree/date-display (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2c195a06ca2577f279d5ec0939d9d958086f361f147e08b200c28786f776ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14128 Malicious code in motionspring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d5f88ace3511b8bc1e45478ab620bdf9fead63cf9e3a1ef19e4b815093d698b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in motionspring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d5f88ace3511b8bc1e45478ab620bdf9fead63cf9e3a1ef19e4b815093d698b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alphazone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fd365bfb46c45371bec3fb53e2e37be369a42ac12a10b3c8ca6ffec7dc604bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14124 Malicious code in alphazone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fd365bfb46c45371bec3fb53e2e37be369a42ac12a10b3c8ca6ffec7dc604bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ANT-2026-XKHXVCFV · supabase/postgres · other

authenticity-not-verified low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XKHXVCFV: Root-executed binaries fetched from S3 without integrity check Several Ansible tasks...

ANT-2026-W77T9B29 · supabase/postgres · other

authenticity-not-verified medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-W77T9B29: CI downloads unverified binary then assumes production AWS role The...

ANT-2026-CT4ZXP4Z · supabase/auth · privilege-escalation

auth-bypass medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CT4ZXP4Z: Parent refresh token of post-MFA token yields AAL2 without MFA In supabase/auth's refresh-tok...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

Exploit for CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Time Zone Abbreviation H...

Malicious code in blastradar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eccd07c931ee578e1201f5fbb7f4610fd5291202c0fcee2b30c959c80c871e The package's index.js loads childprocess, https, and fs at the top level and performs an HTTPS POST that carries host- and installer-identifying dat...

MAL-2026-14120 Malicious code in blastradar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eccd07c931ee578e1201f5fbb7f4610fd5291202c0fcee2b30c959c80c871e The package's index.js loads childprocess, https, and fs at the top level and performs an HTTPS POST that carries host- and installer-identifying dat...

Malicious code in sui-move-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760bce82610adadda6538b9ab04627b71b66c3816fe63f8e1a8f629ce4b4aaf4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...