16142 matches found
MAL-2026-11349 Malicious code in pretty-log-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...
CVE-2026-17686
creationtimestamp| type| source ---|---|--- 2026-07-30 04:47:12+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-08-03 09:52:21+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260803 2026-08-06...
CVE-2026-17919
Google Chrome on Mac versions prior to 151.0.7922.72 is affected by CVE-2026-17919 , which involves insufficient policy enforcement in the Enterprise component. A local attacker with physical access to the device can exploit this flaw to perform privilege escalation . No specific exploit details ...
Malicious code in @ai-agent-node/createnode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...
Malicious code in @zannstore/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 708c069b088fb74064262b95a516de8d4b3f3128bd6705d98ee7e8dc10e942c8 @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to keyword co-occurrence of...
MAL-2026-11176 Malicious code in @bowozzz/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...
CVE-2026-64721
creationtimestamp| type| source ---|---|--- 2026-07-28 04:52:48+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 17:16:28+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15 2026-07-30 16:01:06+00:00|...
MAL-2026-11097 Malicious code in @vaultflow/update-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031c8cb2cc9eb21371fdd4a9a9d6949857fd978868e3dfd8f5d126e95a6a5780 index.js is a verbatim copy of the feross/buffer module with a single injected top-level statement var ins = import'@vaultflow/create-flow' that...
Malicious code in motion-forge-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...
Malicious code in riskunifiedgatewayserv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...
MAL-2026-11098 Malicious code in crm-reportinsightserv-paypal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed758e4154bc29bda7b5ee78165766980d88068090a9853a2243509d97c11152 [email protected] executes a preinstall script index.js that collects installer host identifiers — os.hostname, os.platform, os.arc...
Malicious code in stargateproxyserv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...
MINI-PCWW-RM24-4F67
Bulletin has no description...
Malicious code in kalipto-runtime (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...
MAL-2026-11089 Malicious code in txs-builder (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c934ab0c25791138fe4673ea55529933cc40e3aab0f03a660820712181cd20d No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionality, but without verified...
MAL-2026-11086 Malicious code in fazzgram (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8799da09b9c2cf933d99463789c230da7d238000ba0fde0b311a4050353a6ead fazzgram is a Telegram Bot API wrapper. Supporting modules ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js, Context.js, Markup.js are...
Sandbox Bypass
n8n @n8n/computer-use is vulnerable to Sandbox Escape. The vulnerability is due to missing shell sandbox enforcement on Linux and Windows, allowing computer-use agents to execute unrestricted shell commands with access to the host filesystem and network...
kernel: Fix of 43 CVEs
Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...
autonet-computer (>=0.1.2, <=0.7.3), diap-sdk (>=0.1.4, <=0.1.5) +6 more potentially affected by unknown CVE via libp2p (>=0.1.1, <=0.7.0)
libp2p PYPI version =0.1.1, =0.1.2, =0.1.4, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0a28, =0.1.0a36 Source cves: unknown CVE Source advisory: SNYK:PYTHON-LIBP2P-18313058...