MAL-2026-5135 Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gotestsum, kuberlr, extism, opencost, hey, hivemind, oras, dfc, sriov-network-device-plugin, velero-plugin-for-csi, kubernetes-dashboard, envconsul, kuberay-operator, kube-fluentd-operator, gitsign, terraform-mcp-server, terraform-provider-azuread,...

CVE-2021-3864 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu-melange, linux-qemu...

GHSA-9682-F2FR-3H46 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu-melange, linux-qemu...

GHSA-R4VM-3MC7-PRGX vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-aws...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: external-secrets-fips, azure-aad-pod-identity-mic, k8ssandra-operator-fips, kube-fluentd-operator, gatus, volume-modifier-for-k8s, prometheus-mysqld-exporter, mc-fips, filebrowser, etcd, rancher-helm, amazon-k8s-cni, kubernetes-fips,...