CVE-2026-3020 Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web

Identity based authorization bypass vulnerability IDOR that allows an attacker to modify the data of a legitimate user account, such as changing the victim's email address, validating the new email address, and requesting a new password. This could allow them to take complete control of other...

MAL-2026-1450 Malicious code in @myisrfn/baileys-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc229f53299b669d5c48d802a9d0a7766546ae0908e4b83ed04c51d34c97e482 The package @myisrfn/baileys-mod was found to contain malicious code. Source: ghsa-malware...

Malicious code in @sheniraid/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec58e185ed8a16337c255a734dd403cfc5efd957a33d7a0f978e91721a69c8f5 The package @sheniraid/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1451 Malicious code in @sheniraid/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec58e185ed8a16337c255a734dd403cfc5efd957a33d7a0f978e91721a69c8f5 The package @sheniraid/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1452 Malicious code in @sheniraid/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f232c1235fdee715d838e2f39abd6c3510308c313c075458df080ce28a4c26fa The package @sheniraid/libsignal-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in es-lint-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb77bc53967094108e0dec0e00ddd13bef1d74b3482d959c28c4fc13753cd49 The package es-lint-builder was found to contain malicious code. Source: ghsa-malware e4f62649e3a09df9cabfd19d23538447b0d8762de9506c23c5b27c4a6882967...

MAL-2026-1443 Malicious code in es-lint-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb77bc53967094108e0dec0e00ddd13bef1d74b3482d959c28c4fc13753cd49 The package es-lint-builder was found to contain malicious code. Source: ghsa-malware e4f62649e3a09df9cabfd19d23538447b0d8762de9506c23c5b27c4a6882967...

MAL-2026-1442 Malicious code in bignumber-tool.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81863c7d661d7e537eb4cafb3e74ae83b61483b4617c03f6a4283d34ce651102 The package bignumber-tool.js was found to contain malicious code. Source: ghsa-malware...

Malicious code in bignumber-tool.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81863c7d661d7e537eb4cafb3e74ae83b61483b4617c03f6a4283d34ce651102 The package bignumber-tool.js was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1447 Malicious code in testpoc01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6659b3a51b9c0a2a51085f5c9671114871ac5dfccc6917f74afdd6172aa0e9dc The package testpoc01 was found to contain malicious code. Source: ghsa-malware 317141d91ff4f1ed0410aab99492b3788e3951ef5a06d3fd1b83cec8d2745375 Any...

Malicious code in @omhc/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec8ea3d7c4e55ca61042360855fdfb951544cf58586c2f782e60ac9cef49c03a The package @omhc/libsignal-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1446 Malicious code in omhcsilence-bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f5390575abcab0cfc57edaae4aa14d27eab897c1639fab8a502fcda0760adc3 The package omhcsilence-bails was found to contain malicious code. Source: ghsa-malware...

Malicious code in nest-moralis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568b91354492a39b40ca156221b4a94c94808517fbf09ae48954ba5da0febfd The package nest-moralis was found to contain malicious code. Source: ghsa-malware f5ebd5810f65b46e709e5d8a09a1b3a421a0aac599af1ef51e8bb433afddba48 A...

MAL-2026-1445 Malicious code in nest-moralis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568b91354492a39b40ca156221b4a94c94808517fbf09ae48954ba5da0febfd The package nest-moralis was found to contain malicious code. Source: ghsa-malware f5ebd5810f65b46e709e5d8a09a1b3a421a0aac599af1ef51e8bb433afddba48 A...

MAL-2026-1448 Malicious code in up2-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc22b1546303513e047c5c729ec0f40a5880bf1dd5981592933c689f4cbf3e6 The package up2-daemon was found to contain malicious code. Source: ghsa-malware 4b6e1244d13ef29a84a4b55701182d9aacbd9feb8c6979534eb0493c28ab6e9a Any...

Malicious code in yoshi-base (npm)

The package 'yoshi-base' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

Malicious code in transform-jscript (npm)

The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in developit (npm)

The package 'developit' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

MAL-2026-1573 Malicious code in transform-proto-to-assign (npm)

The package 'transform-proto-to-assign' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in ignore-html-and-css-imports (npm)

The package 'ignore-html-and-css-imports' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...