MAL-2026-5135 Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: filebrowser, cilium, crossplane-provider-sql, nri-redis, fscrypt, etcd, terraform-provider-pagerduty, yam, flux, age, falco-no-driver, nri-couchbase, nats-top, mailpit, spire-controller-manager, terraform-provider-aws, memcached-exporter, metrics-agent, wal-g, cue,...

CVE-2021-3864 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-vmware...

GHSA-9682-F2FR-3H46 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-vmware...

GHSA-R4VM-3MC7-PRGX vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-azure...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: loki-fips, falco-exporter, fluent-operator, helm, tflint, descheduler-fips, dynamic-localpv-provisioner, crossplane-provider-aws, bom, openbao-fips, oauth2-proxy-fips, crossplane, amazon-k8s-cni-fips, istio-pilot-discovery, neuvector-scanner, temporal-ui-server,...