Malicious code in @apicity/meta (npm)

Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload host in the TanStack/Shai-Hulud npm supply-chain compromise...

@holocronlab/botruntime-adk (>=2.0.10, <=2.9.7), @holocronlab/brt (>=0.5.8, <=0.12.3) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.9.7)

@holocronlab/botruntime-runtime NPM version 2.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk =2.0.10, =0.5.8, =0.12.3 Source cves: unknown CVE Source advisory:...

@holocronlab/botruntime-adk (2.5.4), @holocronlab/brt (0.9.3) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.5.4)

@holocronlab/botruntime-runtime NPM version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.5.4 - @holocronlab/brt 0.9.3 Source cves: unknown CVE Source advisory...

@ccfly/setup (0.1.1) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.1)

@ccfly/setup-linux-x64 NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.2) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.2)

@ccfly/setup-linux-x64 NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.9)

@ccfly/setup-linux-x64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@apicity/mcp-server (0.8.1) potentially affected by unknown CVE via @apicity/meta (0.8.1)

@apicity/meta NPM version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.6) potentially affected by unknown CVE via @apicity/meta (0.8.6)

@apicity/meta NPM version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

MAL-2026-13412 Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

bromure agentic-coding-v4.5.4

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...

secMONSTER

🚀 secMONSTER - Advanced Security Assessment & Exploitation Fra...

RLSA-2026:49838 Important: osbuild-composer security, bug fix, and enhancement update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

osbuild-composer security, bug fix, and enhancement update

An update is available for osbuild-composer. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images an...

PT-2026-70199

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.6 Craft CMS versions 4.0.0-RC1 through 4.18.2 Description A remote code execution issue exists in the Twig sandbox mechanism. The software marks the ElementInterface as safe using the AllowedInSandbox...

CVE-2026-64655: Incorrect Regular Expression

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

PT-2026-68766

Name of the Vulnerable Software and Affected Versions GitHub CLI gh versions prior to 2.97.0 Description The gh attestation verify command fails to escape regex metacharacters when building the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values...

RockyLinux 9 : osbuild-composer (RLSA-2026:49838)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49838 advisory. crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32281 crypto/x509: crypto/tls: golang: Go:...

safe-chain v1.5.15

Aikido Safe Chain ✅ Block malware on developer laptops and CI/CD ✅ Supports npm and PyPI more package managers coming ✅ Blocks packages newer than 48 hours without breaking your build ✅ Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...

@whalent/agent (0.3.291) potentially affected by unknown CVE via @whalent/agent-core (0.3.291)

@whalent/agent-core NPM version 0.3.291 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.291 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...