MAL-2026-5135 Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: step, azure-workload-identity-webhook, dask-gateway, chisel, prometheus-operator, vault-env, sigstore-scaffolding, argo-events, flux-source-controller, kyverno-policy-reporter-kyverno-plugin, s5cmd, victoriametrics, rclone, docker-cli-buildx, pvc-autoresizer, trillia...

GHSA-9682-F2FR-3H46 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu-melange, linux-qemu...

CVE-2021-3864 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu-melange, linux-qemu...

GHSA-R4VM-3MC7-PRGX vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp, linux-aws...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, terraform, prometheus-stackdriver-exporter, karpenter-fips, splunk-otel-collector, azcopy, prometheus, kapp-controller, gcp-compute-persistent-disk-csi-driver, kubernetes-csi-livenessprobe-fips, rancher-agent,...