MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...

MAL-2026-10683 Malicious code in formatters.ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname,...

CVE-2025-27150: Insertion of Sensitive Information into Externally-Accessible File or Directory

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access t...

PT-2025-9687 · Unknown +2 · Tuleap Enterprise Edition +2

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 16.4.99.1740492866 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11 Description: The issue concerns the management of sensitive information, specifically the password for connecting to the Redis instance...

Malicious code in openssl-node (npm)

This package executes a post-install script to collect system data and sends it to a remote server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06f19e257e800106253b9b27f14e1caac48d65284d85d47aa244d8aa9bfc97a8 Any computer that has this package installed or runni...