@aokyra/baileys (2.0.6), @arceos/baileys (>=10.0.0, <=10.0.4) +72 more potentially affected by unknown CVE via @shennmine/libsignal-node (0.0.1-security)

@shennmine/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @shennmine/libsignal-node and may be impacted: - @aokyra/baileys 2.0.6 - @arceos/baileys =10.0.0, =2.0.3, =1.0.0, =1.0.0, =1.0.3, =1.0.6, =3.2.4, =2.1....

MAL-2026-2160 Malicious code in chai-as-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bcf6b93b6186112457361f81d21c00830bf0c48c75763de88d97f1b075944cf The package chai-as-chain was found to contain malicious code. Source: ghsa-malware 1d06397b7e66c2a8ecf1542a1f7d18b0f5a87d08a276dc88f77b1f8b2d818d47...

Malicious Package

Overview chai-as-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in chai-as-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bcf6b93b6186112457361f81d21c00830bf0c48c75763de88d97f1b075944cf The package chai-as-chain was found to contain malicious code. Source: ghsa-malware 1d06397b7e66c2a8ecf1542a1f7d18b0f5a87d08a276dc88f77b1f8b2d818d47...

Malware in chai-as-chain

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2026-25921

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

SUSE CVE-2026-28407

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archiv...

SUSE CVE-2026-33634

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious...

Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

In this article 1. Analyzing the Trivy supply chain compromise 2. Detection and investigation 3. Mitigation and protection guidance 4. Advanced hunting queries 5. References 6. Learn more On March 19, 2026, Trivy, Aqua Security’s widely used open-source vulnerability scanner, was reported to have...

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management

Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for...

netfilter Heap Buffer Overflow DoS

The vulnerability of the nftdochain function in the net/netfilter/nftablescore.c module of the netfilter component of the Linux operating system is related to improper initialization. Exploiting this vulnerability could allow an attacker to cause a service failure...

Cisco IOS XE Software for Catalyst Rugged Series Switches Secure Boot Bypass (cisco-sa-xe-secureboot-bypass-B6uYxYSZ)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series Switches, Cisco Catalyst IE9310 and IE9320 Rugged Series...

PT-2026-28180

Name of the Vulnerable Software and Affected Versions OpenTelemetry Java Instrumentation versions prior to 2.26.1 Description The Java instrumentation for OpenTelemetry registers a custom endpoint that deserializes incoming data without applying serialization filters. An attacker with network...

CVE-2026-20104: Buffer Underwrite

A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series Switches, Cisco Catalyst IE9310 and IE9320 Rugged Series Switches, and Cisco IE3500 and IE3505 Rugged Series Switches could allow an authenticated, local...

PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token

Summary PinchTab v0.7.7 through v0.8.4 contain incomplete request-throttling protections for auth-checkable endpoints. In v0.7.7 through v0.8.3, a fully implemented RateLimitMiddleware existed in internal/handlers/middleware.go but was not inserted into the production HTTP handler chain, so...

Understanding Wiz’s Approach to Securing the AI Supply Chain

As organizations race to deploy AI, securing the rapidly expanding ecosystem of models, data, and dependencies has become a critical priority, much of which can be addressed by Wiz’s CNAPP solution...

EUVD-2026-14601

Trivy ecosystem supply chain was briefly compromised...

Malicious code in chain-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53cc34f0f3bb0c4829ea6a271ba921ebdd97ea8272285dbc159f5ede247d27ff The package chain-multer was found to contain malicious code...

MAL-2026-2343 Malicious code in chain-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53cc34f0f3bb0c4829ea6a271ba921ebdd97ea8272285dbc159f5ede247d27ff The package chain-multer was found to contain malicious code...

MAL-2026-2341 Malicious code in chai-chain-cognivault (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19b0851e6e0e1c6814315a7876df23ebeb1c80c5afd8093f9790c0b2fb6ba605 The package chai-chain-cognivault was found to contain malicious code...