Malicious code in @yane88/idea-2026.2-05 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5865c413c00416de3502791f9af838084ce486d92080591868a79bab3e346aa8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

The U.S. Department of Justice DoJ on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted. Last week, the DoJ said the National Aeronautics and...

SIR: Self-Improving Red-Teaming for Compute Use Agents

Computer use agents CUAs are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal, and they are increasingly deployed to automate everyday digital tasks. Because they can be exposed to untrusted content while operating, they are...

MAL-2026-14653 Malicious code in 3layerdipstack7d0vc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0ec71b1f453c0b7e55711dad1fa36e9df70acb84f3730568936593cb146817f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack1qjbr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85d784088394499921a432bb36d6146bddcad370b54c16047eb8c12d1baf9b25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack1ew1w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86ccae74f5b5566c179524a998db3f813a1909c84b366f4f8a8e655520da66e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15211 Malicious code in desmos-graphing-abi6w1hy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6ce7dcc2c2141090a0930c5c484f9a4a7450f7500184054651f336fdf0c1802 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-dskw2g17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f2d0a916b07fd12dcc681669c0f0dcea0eb932c52360f7eb3890db023bd22f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-fndndxw5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a6a223d9f1a80f9abeeabc995ebc539d59a16f9596264ce0ac203f279ad78e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-bae1zj6h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8052ae0b602701f61914e56613799c3955ec1bb9bd450f27e69a2627100a5c74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Breaking Darknet CAPTCHAs with General Purpose LLM

Our work evaluates the effectiveness of automated methods for solving CAPTCHA challenges commonly encountered in darknet environments. These CAPTCHAs are typically designed to operate without JavaScript, resulting in distinct characteristics compared to mainstream CAPTCHA systems. Our study...

Malicious code in superdupertest111 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dafc169a0c96b769349ac7685ff37d6ad663db50df14862a784173cde38dbe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-16286: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...

[SECURITY] Fedora 44 Update: i2c-display-0.5.4-1.fc44

A Go application for Single Board Computers Raspberry Pi 3/4, Rock 3C that controls I2C OLED displays SSD1306, SH1106, etc. showing system stats and network information with rotating pages. Features: - System monitoring disk, RAM, CPU temperature - Network interface information - Automatic page...

skyvern v1.0.50

🐉 Automate Browser-based workflows using LLMs and Computer Vision 🐉 Skyvern automates browser-based workflows using LLMs and computer vision. It provides a Playwright-compatible SDK that adds AI functionality on top of playwright, as well as a no-code workflow builder to help both technical and...

Malicious code in expect-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17d9530bd098ecda5041341a338be1a2cfaab1f19e907252bbc95cdd2577dba1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Azure cloud services authentication Privilege Escalation

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

MAL-2026-14014 Malicious code in try-lock-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 941a65c056bbb40a20dd7b1f4107bf804df157df12ea0b89067fc6770afe3b6b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13800 Malicious code in cvvkshuelwiu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3f325329894b841474989d30370570a7f1b68d02334db1b98dcaf109899fa9 Package [email protected] contains 2 files with no a static rule matches and no traced behaviors of concern. No install-time scripts, network...

Malicious code in csbcldfvivwfgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21 The package contains a single index.html declared as main. The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style...