14132 matches found
MAL-2026-14317 Malicious code in fetch-webjs-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d04692f011c8f5c87f51cd80b38eeb96ef1dc9eb0f98f6c141c97c639958a7eb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
`internment` 0.8.7 was removed from crates.io due to a malicious dependency
A new version of the internment crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 90 minutes later. The compromised version was used as part of...
RUSTSEC-2026-0259 `arone` was removed from crates.io due to malicious code
We identified that arone contained malicious code executed through a build script. This crate had 7 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io on 2026-08-20 and the user account was locked. This crate was used as part of a malware campai...
RUSTSEC-2026-0264 `proc-macro-en` was removed from crates.io due to malicious code
We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...
RUSTSEC-2026-0262 `append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was use...
`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was use...
RUSTSEC-2026-0260 `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...
`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...
`proc-macro1` was removed from crates.io due to malicious code
It was reported proc-macro1 contained a build script that would download a malicious payload. This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users ...
`aronenao` was removed from crates.io due to malicious code
We identified that aronenao contained malicious code executed through a build script. This crate had 11 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io and the user account was locked. This crate was used as part of a malware campaign targete...
`proc-macro-en` was removed from crates.io due to malicious code
We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...
RUSTSEC-2026-0265 `proc-macro1` was removed from crates.io due to malicious code
It was reported proc-macro1 contained a build script that would download a malicious payload. This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users ...
OESA-2026-3459 python-cryptography security update
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Security Fixes: python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that...
OESA-2026-3458 python-cryptography security update
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Security Fixes: python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that...
OESA-2026-3457 python-cryptography security update
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Security Fixes: python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that...
Malicious code in @httttt/mcp-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2914b799b1c4e540a2ff20338186041f8053fd03cc28ad544ecdb36531a33278 The package's main/bin entry contains a top-level await execAsync... that downloads a file named javaagent from...
GO-2026-6223 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-fips, kubeflow-pipelines, kubeflow-pipelines-driver-fips...
GO-2026-6095 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-opensearchserverless-fips, crossplane-provider-aws-dlm-fips, crossplane-provider-aws-ssoadmin, crossplane-provider-aws-evidently, crossplane-provider-aws-dynamodb-fips, crossplane-provider-aws-amplify, crossplane-provider-azure-synapse,...
GO-2026-6213 vulnerabilities
Vulnerabilities for packages: syft-fips, scorecard, argo-workflows, google-osconfig-agent, cerbos-fips, external-secrets-operator-fips, boring-registry, kubescape-server-fips, grafana-alloy-fips, flux-source-controller, gitlab-runner-fips, nuclio-controller-fips, semaphore, gitea, k9s, teleport,...
