DARWIN

🧬 DARWIN Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection An evolutionary attack–defense framework that couples DARWIN-Attack with DARWIN-Guard through online adversarial training. Paper · Guard Checkpoint · Installation · Use DARWIN-Attack · Use DARWIN-Guard ·...

xnu

What is XNU? XNU kernel is part of the Darwin operating system for use in macOS and iOS operating systems. XNU is an acronym for X is Not Unix. XNU is a hybrid kernel combining the Mach kernel developed at Carnegie Mellon University with components from FreeBSD and a C++ API for writing drivers...

CVE-2024-24787-PoC

CVE-2024-24787-PoC On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -ltolibrary flag in a "cgo LDFLAGS" directive. This is not my bug, I just made a PoC for it. Reference...

Malware in @zread/cli-darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @zread/cli-darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @rclaude/darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-19234 Malicious code in @rclaude/darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f91948fabd49378c8525b08dcf47aefe5bcaddf61e757600cf426aee0d9e58d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @rclaude/darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f91948fabd49378c8525b08dcf47aefe5bcaddf61e757600cf426aee0d9e58d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

DEBIAN-CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

EUVD-2026-123109

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

CVE-2026-97036

The Go toolchain (cmd/go) is vulnerable on Darwin systems when building packages that use cgo . An attacker can achieve arbitrary code execution by providing a malicious package containing a "#cgo LDFLAGS" directive with the arguments "-l to_library ". This works because the Apple linker recombin...

CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

PT-2026-144959

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description On Darwin, building a malicious package using cgo can lead to arbitrary code execution when utilizing the Apple linker. This occurs when a cgo LDFLAGS directive passes -l to library , causing the...

CVE-2026-97036: Go toolchain cmd/go: On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker…

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

Malware in @liauto/darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@anthropic-ai/claude-code (>=2.1.116, <=2.1.250), @chude/memory (>=4.0.0, <=4.0.3) +9 more potentially affected by CVE-2026-88968 via @anthropic-ai/claude-code-darwin-x64 (>=2.1.116, <=2.1.250)

@anthropic-ai/claude-code-darwin-x64 NPM version =2.1.116, =2.1.116, =4.0.0, =0.8.0, =1.30.1-broken.0, =0.1.44-easy.50, =0.4.1, =2.1.207, =0.1.0, =2.8.0, =2.10.1 Source cves: CVE-2026-88968 Source advisory: MEND:CVE-2026-88968...

@anthropic-ai/claude-code (>=2.1.116, <=2.1.250), @chude/memory (>=4.0.0, <=4.0.3) +9 more potentially affected by CVE-2026-88968 via @anthropic-ai/claude-code-darwin-arm64 (>=2.1.116, <=2.1.250)

@anthropic-ai/claude-code-darwin-arm64 NPM version =2.1.116, =2.1.116, =4.0.0, =0.8.0, =1.30.1-broken.0, =0.1.44-easy.50, =0.4.1, =2.1.207, =0.1.0, =2.8.0, =2.10.1 Source cves: CVE-2026-88968 Source advisory: MEND:CVE-2026-88968...