MAL-2026-5135 Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: pvc-autoresizer, gops, rabbitmq-messaging-topology-operator, shfmt, aws-signer-notation-plugin, prometheus-pushgateway, argo-events, dive, nri-mongodb, newrelic-k8s-metadata-injection, rancher-helm, secrets-store-csi-driver-provider-aws, flux-source-controller,...

CVE-2021-3864 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu, linux-qemu-melange...

GHSA-9682-F2FR-3H46 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu, linux-qemu-melange...

GHSA-R4VM-3MC7-PRGX vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-azure...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: traefik, flux-notification-controller-fips, kube-logging-operator, cert-exporter-fips, glab, nerdctl, multus-cni, thanos, spark-operator-fips, velero-fips, loki, kots, newrelic-k8s-metadata-injection-fips, prometheus-podman-exporter-fips, newrelic-nri-kube-events,...