Malicious Package

Overview cloud-config-fetcher is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in cloud-config-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a19fd2daa8759d7f8a31f0b54cffd70e5769e2268a447f8ba0b890006edee17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

The risk hiding behind exposed MCP servers

How unauthenticated Model Context Protocol MCP servers are opening doors to sensitive cloud data, IAM, and command execution...

CVE-2026-43910

CVE-2026-43910 affects the Appium Java Client (8.2.1–10.1.1). When directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() rebuilds the client’s server URL from directConnectHost, directConnectPort, and directConnectPath in the server’s NEW_SESSION response, validating only HTTPS...

CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

MAL-2026-11134 Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

Malicious code in text-line-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...

MAL-2026-11151 Malicious code in text-line-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...

JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach

JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog's software repository manager. OpenAI says the models then escalated privileges and moved laterally until they...

Docker Cloud Yaml - File Disclosure Detection

Docker cloud internal yaml file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Docker cloud internal yaml file is exposed.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Docker Cloud Yaml - File...

SAP Spartacus detect

Spartacus is a lean, Angular-based JavaScript storefront for SAP Commerce Cloud that communicates exclusively through the Commerce REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Spartacus is a lean, Angular-based JavaScript storefront for SAP Commerce Cloud that communicates exclusively...

SAP Analytics Cloud Panel - Detect

SAP Analytics Cloud panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Analytics Cloud panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAP Analytics Cloud Panel - Detect',...

Qualys Cloud Platform Login Panel - Detect

Qualys Cloud Platform login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualys Cloud Platform login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualys Cloud Platform Login...

ZhongQing Education Cloud Platform - Information Exposure Detection

Zhongqing Naboo Education Cloud Platform is a deep application supporting teaching and research. Information leakage and unauthorized access exist in the cloud platform system. The password can be reset to 123456 through the leaked user name. The application system does not effectively verify...

IMO - Arbitrary File Download Detection

The imo cloud office can read system sensitive files because the filename parameter of the /file/Placard/upload/ImoDownLoadUI.php page is not strictly filtered. !/usr/bin/env python3 -- coding: utf-8 -- """The imo cloud office can read system sensitive files because the filename parameter of the...

Ivanti(R) Cloud Services Appliance - Panel Detection

An Ivanti Cloud Services Appliance panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Ivanti Cloud Services Appliance panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IvantiR Cloud...

VMware Cloud Director Availability Login Panel - Detect

VMware Cloud Director Availability login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Cloud Director Availability login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...