MAL-2026-14105 Malicious code in bcs-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd676f5c862ca8046400db51b6ccdc4eea5c3fa913548c1eb7679a22653a3f05 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in leb128x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3862797564b06cd20320cecbdadcdd30bd5506e9afc09ed1f2ce225c22e5c8 The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires perf.js, which on load reads /.sui/sui.keystore,...

Malicious code in reseller-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5e549688dcd67cfcc86be1c65c7831f7c730036626c41484332cf7dca2d7fee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in club-sauce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5b5234f79f70ac18cfbd80c2e2cf922e3f151b38d807627feb087a35f7c645 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14107 Malicious code in club-sauce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5b5234f79f70ac18cfbd80c2e2cf922e3f151b38d807627feb087a35f7c645 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CGA-G972-9X54-3262

Bulletin has no description...

MAL-2026-14111 Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14106 Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in junofficial-userbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 167c22b6f010e1ce90c0a5e1ac3ea0d0b6340486f3c83df4d5f2342724575b4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in userbotjs-jun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 874844845d90204790121d44266ee3bd0da34f2bd84e7905cedba27583c71b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14101 Malicious code in @junofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce5b57f62207e6e6dc46974d3544def4d670aeb1837363b83c4e9b4f49ccd0dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in autoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e2f80495807b8e77521a7d5bcba68a0ba790db0ca08a3d14450f568165217d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in userbotjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0afcc62f361549813f605462124928c14c5228ba1d87e19adea38cc5e13c3609 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14115 Malicious code in userbotjs-jun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 874844845d90204790121d44266ee3bd0da34f2bd84e7905cedba27583c71b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14104 Malicious code in autoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e2f80495807b8e77521a7d5bcba68a0ba790db0ca08a3d14450f568165217d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @junofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce5b57f62207e6e6dc46974d3544def4d670aeb1837363b83c4e9b4f49ccd0dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14102 Malicious code in @siwatfa/yorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @siwatfa/yorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

glassworm-hunter v1.0.4

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...