Malicious code in enumerate-iam (PyPI)

Source: checkmarx bfefcae6c29da10e63d630fc7e012995d730cc5c0af3a8144dc517f26382a3bd Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security cc5e304091eeb9848bd177dfd300a7df7778e3913b42af19741f6cddec4be752 Attack targeted ...

Malicious code in django-b64-img (PyPI)

Source: kam193 f5ebdaebc61cf7a888322348e074f219519b7d09a24ab91732d8bc5061d86b2e The package provides a special image-storing field for Django REST Framework based on a legitimate implementation from the Hipo/drf-extra-fields repository. The malicious modification appends the cloud credentials and...

Malicious code in cscc-glass-house (PyPI)

Source: kam193 20f53888d08d0aa70146b50e8dc761373490363f9081ea0adb9fb93cfd2b6240 Package implements exfiltrating credentials from cloud environments to a hardcoded location. Some code parts suggest it may be part of a CTF. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in credential-python-sdk (PyPI)

Source: kam193 6c6598ac9c321af3b0526ddceb5ffc6e78d593e0c3e6bdd259b06c0792705cc6 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in cloud-datasets (PyPI)

Source: kam193 7cbbef34e9c8a9e6db79ffb59dde86dafe9734166f201aae8a5d1837ac262fc0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in cloud-credentials (PyPI)

--- Credit: OpenSSF source...

Malicious code in cache-compat-utils (PyPI)

Source: amazon-inspector 70fc75889476bd737b302c856fb1d2da1b263a93786bc27fed3978c3eb0584cd The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 3abe4019efea5cdd405c9129e127f5d8b05456422574e40b01c6ec3b10177975 The package contains...

Malicious code in bt-signal-utils (PyPI)

Source: kam193 d56152c37c3a078b771d2578dd86495783b51b886c96aa7ebb66a7ec36d72a24 During import, package exfiltrates environment variables and cloud tokens to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in awscloud-clients-core (PyPI)

Source: kam193 e27bf5713a8bafdbcc34c43b98cc4d5e9c5d03e4952f788b12ff9749081b22d2 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in aws-consoler2 (PyPI)

Source: checkmarx b37bd86b6f9bda9d03029c9d2fa09561b2b43cda7c3fddda1389c8e193c4a938 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 24f9ca302dd0a2aabb28a665dbf8cdd392abc96f92dda8f8b994bf46836621cc Attack targeted ...

Malicious code in amzclients-sdk (PyPI)

Source: kam193 7918a5aab99f521336ce5a17ca3b3dae77256011f91ed8dc22c4d9a38123f539 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in aliyun-oss2 (PyPI)

Source: checkmarx 8c33f6b28da216b43120a3b8a8537d0263dc1eb2b22979a4183b371ff57b9e0b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security a47b0bcf41b0d36b78b3429f9f22415630b3870da18554d21c2123212bc992f4 Attack targeted ...

Malicious code in alicloud-client (PyPI)

Source: kam193 6366aa8c2eff918da0f1cc2118a026e749592f71bebbe81215877575b9593c6a This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in alibabacloud-vpc20180317 (PyPI)

Source: checkmarx 0c24b33d1db8fffd5daaf1985d25add4bc66e7879e1a6efbc7ae706816931834 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 54cd0ad4627d65e2f30a3b3b165148a924014b94af0d3a6a0b23a265f2b02b4c Attack targeted ...

Malicious code in aclient-sdk (PyPI)

Source: kam193 aa9e5d91a1f45bce354edc5b12fcacf603db5e00dc4a48628d3fe5fff37d0eb2 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in acloud-clients (PyPI)

Source: kam193 89813876cca364b0dffda624005d527aa3c9f54ea7ce20af8186faf8f374ba6f This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL API when public introspection is disabled. An attacker can obtain hidden schema...

Agentless Threat Detection: Illuminating Cloud Blind Spots

How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks...

CVE-2026-64627

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CLEANSTART-2026-NW12954 Security fixes for CVE-2020-8908, CVE-2023-2976, CVE-2025-67735, CVE-2026-0636, CVE-2026-1225, CVE-2026-22741, CVE-2026-22745, CVE-2026-22746, CVE-2026-22751, CVE-2026-33870, CVE-2026-33871, CVE-2026-40973, CVE-2026-41284, CVE-2026-41293, CVE-2026-41417, CVE-2026-42498, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-50020, CVE-2026-5598, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5mg8-w23w-74h3, ghsa-5x3r-wrvg-rp6q, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-84h7-rjj3-6jx4, ghsa-c2gf-v879-257j, ghsa-c653-97m9-rcg9, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-pwqr-wmgm-9rr8, ghsa-qqpg-mvqg-649v, ghsa-v8h7-rr48-vmmv, ghsa-w9fj-cfpg-grvv, ghsa-wwpq-f5c3-7hvx, ghsa-x4gw-5cx5-pgmh, ghsa-xxqh-mfjm-7mv9 applied in versions: 4.3.2-r2, 4.3.2-r3

Multiple security vulnerabilities affect the cloud-config-server package. These issues are resolved in later releases. See references for individual vulnerability details...