MAL-2026-16011 Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

Malicious code in orbitron-cli (npm)

The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

MAL-2026-16014 Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

PT-2026-86172

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to commit 4472a31 Description A stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. This occurs because several command-line handling paths write an...

PT-2026-85553

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validate command with operators function when ALLOW SHELL OPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWED...

CVE-2026-85660: Improper Neutralization of Special Elements used in an OS Command

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

PT-2026-86171

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall handle up down in cli telnet.c. This affects only applications that...

CVE-2026-57166: Stack-based Buffer Overflow

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amoun...

CVE-2026-57165: Stack-based Buffer Overflow

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall handleupdown in clitelnet.c. This affects only applications that enab...

MAL-2026-16012 Malicious code in orbitron-cli (npm)

The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

MAL-2026-16013 Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62681 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-62681 Source advisory: OSV:GHSA-FG9P-MRXR-HVQ7...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62682 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-62682 Source advisory: OSV:GHSA-88F2-FPV8-89Q2...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-72717 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-72717 Source advisory: OSV:GHSA-W727-8J6C-2RJ4...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71869 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71869 Source advisory: OSV:GHSA-2H9G-J24R-H63G...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71871 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71871 Source advisory: OSV:GHSA-8J6P-R8JG-MXQH...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71867 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71867 Source advisory: OSV:GHSA-2W86-XFRC-G85R...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71868 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71868 Source advisory: OSV:GHSA-3575-W9FC-C2J6...