MAL-2026-17642 Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

DepFuzzer

DepFuzzer DepFuzzer es una herramienta utilizada para encontrar confusión de dependencias o proyectos donde el correo electrónico del propietario puede ser secuestrado. Instalar la herramienta /!\ Esta herramienta requiere python = 3.10 /!\ $ python3 -m venv .venv $ source .venv/bin/activate $ pi...

CVE-2026-93675

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

MAL-2026-17640 Malicious code in browser-metrics-plugin.contrib (npm)

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install,...

EUVD-2026-94115

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

CVE-2026-93675

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to an arbitrary code execution flaw. The root cause is identified as an expected dependency confusion vulnerability. A remote attacker could exploit this issue to execute code on the target system. No specific exploits or scanner sourc...

confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

confused

Confused 用于检查依赖配置中引用的私有包名称是否存在未认领的命名空间，支持 Python（pypi）requirements.txt、JavaScript（npm）package.json、PHP（composer）composer.json 或 MVN（maven）pom.xml。 这是什么？ 2021年2月9日，安全研究员 Alex Birsan 发表了一篇文章，涉及多种编程语言生态系统中依赖管理工具存在的不同解析顺序缺陷。 微软发布了一份白皮书，描述了缓解影响的方法，但根本原因仍然存在。 解读工具输出 confused...

combobulator

Dependency Combobulator Dependency Combobulator 是一个开源、模块化、可扩展的框架，用于检测和防止依赖混淆泄露及潜在攻击。它提供了一种整体性的方法，确保安全的应用发布，并能针对不同来源（如 GitHub Packages、JFrog Artifactory）和多种包管理方案（如 npm、maven）进行评估。 目标受众 该框架可供安全审计人员、渗透测试人员使用，甚至可以自动化地嵌入企业应用安全程序及发布流程中。 主要特性 可插拔 - 可在 SDLC 的提交、构建、发布阶段介入。 可扩展 - 轻松添加您自己的包管理方案或代码来源。 通用启发式引...

linux-root-kit

Acerca de Este Proyecto Este proyecto fue desarrollado como parte del curso de Digitale Forensik en la Technische Hochschule Deggendorf. Demuestra una investigación forense completa y una simulación de ataque que involucra: Un ataque de confusión de dependencias en Python utilizando un paquete...

Malicious code in css-nrmgzn-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...

Malicious code in css-yhpodl-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5936fc65b4eba7b461c0eef7b66dfeecdc2da412f54fd667873e3e6950b0a857 css-yhpodl-polyfill ships thunderboltRegistry.js which, as an IIFE executed on require, runs shell reconnaissance id, whoami, env, ifconfig/ip addr,...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

MAL-2026-17542 Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

MAL-2026-17543 Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

MAL-2026-17510 Malicious code in internallib_v275 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...

Malicious code in internallib_v275 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...

Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...