MAL-2026-16011 Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

MAL-2026-16014 Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

MAL-2026-16013 Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62681 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-62681 Source advisory: OSV:GHSA-FG9P-MRXR-HVQ7...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62682 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-62682 Source advisory: OSV:GHSA-88F2-FPV8-89Q2...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-72717 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-72717 Source advisory: OSV:GHSA-W727-8J6C-2RJ4...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71869 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71869 Source advisory: OSV:GHSA-2H9G-J24R-H63G...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71871 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71871 Source advisory: OSV:GHSA-8J6P-R8JG-MXQH...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71867 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71867 Source advisory: OSV:GHSA-2W86-XFRC-G85R...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71868 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71868 Source advisory: OSV:GHSA-3575-W9FC-C2J6...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71865 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71865 Source advisory: OSV:GHSA-653Q-5476-X79G...

GHSA-653Q-5476-X79G Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

NPM: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

NPM: Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71864 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71864 Source advisory: OSV:GHSA-6437-GXHQ-PQV8...

threatcl v0.6.8

threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...

jdvrif — Updated!

jdvrif jdvrif JPG Data Vehicle , v9.0 is a fast, easy-to-use steganography command-line tool for concealing and extracting any file type via a JPG image. Linux only. Your data file is compressed with libdeflate/zlib , then encrypted with XChaCha20-Poly1305 libsodium secretstream under a key deriv...

CVE-2026-84452

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

AZL-99165 CVE-2026-78662 affecting package cf-cli for versions less than 8.7.11-9

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99168 CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...