Malicious code in node-dotenv-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b47bebee6a74c00d3be10fad072e05074a62b29205377f682463290bad39c3 The package node-dotenv-cli was found to contain malicious code. Source: ghsa-malware 5bb66069e2bde985ae448962eaaf6373cd54aa2cd51fb20a0fef26ecb5dee2d...

Malicious Package

Overview node-dotenv-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-853 Malicious code in node-dotenv-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b47bebee6a74c00d3be10fad072e05074a62b29205377f682463290bad39c3 The package node-dotenv-cli was found to contain malicious code. Source: ghsa-malware 5bb66069e2bde985ae448962eaaf6373cd54aa2cd51fb20a0fef26ecb5dee2d...

CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

[SECURITY] Fedora 42 Update: rust-oo7-cli-0.3.3-5.fc42

System keyring access from the terminal...

agent-builder (>=0.0.2 <=0.1.7), agent-memory-layer (>=0.1.0 <=0.1.1) +63 more potentially affected by CVE-2026-26013 via langchain-openai (>=1.0.0 <=1.1.7)

langchain-openai PYPI version =1.0.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =3.0.3, =0.0.48, =0.0.54, =0.1.2, =0.1.0, =0.1.0, =0.9.0 and more Source cves: CVE-2026-26013 Source advisory: SNYK:PYTHON-LANGCHAINOPENAI-15263095...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: croc, hubble, dynamic-localpv-provisioner, lvm-driver, kyverno, jaeger-operator, witness, azcopy, ko, terraform-provider-pagerduty, cloudprober, tigera-operator, harbor-registry, incert, mongo-tools, kubernetes-dashboard-web, nri-haproxy, rancher-helm, gomplate,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: croc, hubble, dynamic-localpv-provisioner, lvm-driver, kyverno, jaeger-operator, witness, azcopy, ko, terraform-provider-pagerduty, cloudprober, tigera-operator, harbor-registry, incert, mongo-tools, kubernetes-dashboard-web, nri-haproxy, rancher-helm, gomplate,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: wazero-fips, request-1279, gke-gcloud-auth-plugin, mig-parted-fips, aws-fsx-csi-driver, gitea-fips, prometheus-pgbouncer-exporter-fips, external-dns, sops, grafana-pyroscope, kyverno-policy-reporter-ui-fips, mongo-tools-fips, scanner-test-golang-vulnerability-fixed,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: wazero-fips, request-1279, gke-gcloud-auth-plugin, mig-parted-fips, aws-fsx-csi-driver, gitea-fips, prometheus-pgbouncer-exporter-fips, external-dns, sops, grafana-pyroscope, kyverno-policy-reporter-ui-fips, mongo-tools-fips, scanner-test-golang-vulnerability-fixed,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: request-1279, gke-gcloud-auth-plugin, mig-parted-fips, aws-fsx-csi-driver, prometheus-pgbouncer-exporter-fips, external-dns, sops, grafana-pyroscope, kyverno-policy-reporter-ui-fips, mongo-tools-fips, scanner-test-golang-vulnerability-fixed, spegel-fips,...

[SECURITY] Fedora 43 Update: rust-oo7-cli-0.4.3-4.fc43

System keyring access from the terminal...

[SECURITY] Fedora 43 Update: rust-dua-cli-2.32.2-3.fc43

A tool to conveniently learn about the disk usage of directories, fast!...

GHSA-4255-C27H-62M5 unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log...

Linux Distros Unpatched Vulnerability : CVE-2026-25918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive...

CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

CVE-2026-25918 unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

CVE-2026-25918 unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...