Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

MAL-2026-12251 Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

Malicious code in tinkoff-codeceptjs-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

MAL-2026-11151 Malicious code in text-line-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...

CVE-2026-48034

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

CVE-2026-48034

CVE-2026-48034 affects Hulumi components used with Pulumi. Before v1.4.0, a bypass exists in the decoy-sibling mechanism: an unhardened raw S3 bucket could appear compliant when paired with five hardening siblings that reference a different bucket, allowing a bypass of access controls. The issue ...

CVE-2026-48034 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

CVE-2026-48034 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

CVE-2026-48034

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

CVE-2026-48034 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

EUVD-2026-48734

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

CVE-2026-48034: Improper Access Control

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10502 Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10488 Malicious code in permcarmserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...

Malicious code in type-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f29d6bfc122cb5792d95cfade56e62789f83366b30fc0d58a88a84113d89962c Package impersonates the pino logger README is pino documentation, package name is a lookalike. The main export is a middleware factory that spawns...

[SECURITY] Fedora 43 Update: nmap-7.92-8.fc43

Nmap is a utility for network exploration or security auditing. It supports ping scanning determine which hosts are up, many port scanning techniques determine what services the hosts are offering, and TCP/IP fingerprinting remote host operating system identification. Nmap also offers flexible ta...

Malicious code in chai-as-modified (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e Package name is a 1-2 character variant of the widely-used chai-as-promised plugin. The exported function — the entry point users pass to chai.use...