MAL-2026-5739 Malicious code in sheratan_haha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b473b40e0c041d34e85161ed8c91e0e00d006a0822698a0d3994876cb685ddd On npm install, the package's declared postinstall hook node postinstall.js runs whoami on the installer's machine and POSTs the output to a hardcode...

MAL-2026-5731 Malicious code in houzidawang807 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568d90e7a8d940b5618fa36bccfc2b7fa02ceaa814f0a416d2cc989c685e489 Package advertises itself as 'a simple date formatting utility' but ships an SSH-key-stealing C2 client. postinstall.js enumerates /.ssh for .pub...

MAL-2026-5732 Malicious code in houzidawang808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71d6b96fe99e7f8503cb07df05d6b621dc8e8243fc7288844678d8aff043a654 The package presents itself as a 'simple date formatting utility' index.js exports a trivial formatDate wrapper around toLocaleDateString, but ships ...

CVE-2026-54229

creationtimestamp| type| source ---|---|--- 2026-06-13 05:42:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo5kc74kqz22 2026-06-13 06:57:47+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo5oi7fhpd2b...

MAL-2026-5729 Malicious code in houzidawang806 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbf603db6d0a3434c6c417dd460f26d08b9e230c03926f05987bb3841d3c72b Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. 1 postinstall.js enumerates /.ssh/ for .pub...

CVE-2026-53823

creationtimestamp| type| source ---|---|--- 2026-06-13 01:51:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo55eypeht2v 2026-06-16 06:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mof52ftlwl2o...

CVE-2026-53829

creationtimestamp| type| source ---|---|--- 2026-06-13 01:46:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo5542bayd2j 2026-06-16 07:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mofafocrem27...

CVE-2026-42851

creationtimestamp| type| source ---|---|--- 2026-06-12 22:20:14+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo4rkr3aqf2m 2026-06-13 10:04:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo5yph3aqi2y 2026-08-09 18:21:53+00:00| seen|...

CVE-2026-53834 OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering comman...

CVE-2026-24136

creationtimestamp| type| source ---|---|--- 2026-06-12 21:00:04+00:00| published-proof-of-concept| Telegram/8OrsKfIYkEk0-8uPkb8MstgNwn2ZcQVuOnxP5IJIO77AEwY...

GHSA-3G43-6GMG-66JW

creationtimestamp| type| source ---|---|--- 2026-06-12 20:38:57+00:00| seen| https://gist.github.com/konard/f83ae7aaab029a650fe9054d8205dac4...

CVE-2026-9638

creationtimestamp| type| source ---|---|--- 2026-06-12 15:58:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo44a67sb42j 2026-06-12 18:29:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4enoz4jo22...

CVE-2026-9641

creationtimestamp| type| source ---|---|--- 2026-06-12 15:53:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo43x72deo2v 2026-06-12 18:39:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4f7m6z7522 2026-06-14 10:48:56+00:00| seen|...

CVE-2026-50012

creationtimestamp| type| source ---|---|--- 2026-06-12 12:48:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo3rm3en6x2v 2026-06-15 14:19:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3modi3vazfl2z 2026-06-15 23:59:01+00:00| seen|...

CVE-2026-49482

creationtimestamp| type| source ---|---|--- 2026-06-12 02:15:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2oaoxyim2a...

CVE-2026-47238

creationtimestamp| type| source ---|---|--- 2026-06-12 02:10:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2nxqi4ly23...

CVE-2026-11849

creationtimestamp| type| source ---|---|--- 2026-06-12 01:11:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10972-32032-2.html 2026-06-12 12:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo3ovy7pxt2w 2026-06-12 13:16:58+00:00| seen|...

CVE-2026-44890

creationtimestamp| type| source ---|---|--- 2026-06-12 01:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2k2vte6u2p...

CVE-2026-34692

creationtimestamp| type| source ---|---|--- 2026-06-12 00:03:29+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mo2guhgkry2y...

CVE-2026-45418

creationtimestamp| type| source ---|---|--- 2026-06-12 00:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2gpthu332w 2026-06-12 02:04:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2nmy64fx23 2026-06-12 02:55:48+00:00| seen|...