datupapi (>=0.5.19, <=1.0.3) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.5.0)

snowflake-connector-python PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - datupapi =0.5.19, =1.0.3 Source cves: CVE-2026-15925 Source advisory: OSV:PYSEC-2026-3920...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-67323 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-67323 Source advisory: OSV:PYSEC-2026-3839...

adaptiq (0.12.9), agentic-ai-vass-tools (>=0.1.0, <=0.4.0) +13 more potentially affected by CVE-2026-62240 via crewai-tools (0.76.0)

crewai-tools PYPI version 0.76.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - adaptiq 0.12.9 - agentic-ai-vass-tools =0.1.0, =0.1.7, =0.2.6, =0.1.0, =0.5.42, =0.74.0, =0.0.24, =0.1.0, =0.0.14, =0.1.0, =0.0.1,...

gpopt (>=0.1.0, <=0.2.3) potentially affected by CVE-2026-67322 via gitpython (0.3.6)

gitpython PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - gpopt =0.1.0, =0.2.3 Source cves: CVE-2026-67322 Source advisory: OSV:PYSEC-2026-3842...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-67325 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-67325 Source advisory: OSV:PYSEC-2026-3836...

any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-9769 via justhtml (>=1.1.0, <=1.2.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-9769 Source advisory: OSV:PYSEC-2026-3854...

com.atomicleopard.thundr:thundr-contrib-freemarker (2.0.0-alpha), com.bordereast.ninja:pebble-module (>=0.0.1, <=0.0.2) +102 more potentially affected by CVE-2026-84939 via org.freemarker:freemarker-gae (>=2.3.19, <=2.3.34)

org.freemarker:freemarker-gae MAVEN version =2.3.19, =0.0.1, =0.0.2 - com.dtstack.jlogstash:input.file 1.0.0 - com.dtstack.jlogstash:input.kafka 1.0.0 - com.dtstack.jlogstash:input.stdin 1.0.0 - com.dtstack.jlogstash:input.tcp 1.0.0 - com.dtstack.jlogstash:jlogstash 1.0.0 -...

@13w/local-rag (2.0.0), @apekshik/grok-cli-apek (>=0.1.5, <=0.1.6) +32 more potentially affected by CVE-2026-13745 via @google/gemini-cli (>=0.1.17, <=0.39.0-nightly.20260411.0957f7d3e)

@google/gemini-cli NPM version =0.1.17, =0.1.5, =0.1.0, =1.0.0, =0.0.17, =0.6.4, =0.0.1, =1.3.0, =0.1.4, =0.1.10, =1.0.0, =2.0.0 and more Source cves: CVE-2026-13745 Source advisory: MEND:CVE-2026-13745...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

Malicious code in etoro-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9210fb131a2f661ae1d656fa461d45c6c54377179aecba06e6a07b4f357a00b The package's preinstall lifecycle script preinstall.js reads the installer's OS hostname, username, and current working directory via os.hostname,...

MAL-2026-16116 Malicious code in etoro-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9210fb131a2f661ae1d656fa461d45c6c54377179aecba06e6a07b4f357a00b The package's preinstall lifecycle script preinstall.js reads the installer's OS hostname, username, and current working directory via os.hostname,...

Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

MAL-2026-16111 Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

MAL-2026-16112 Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

MAL-2026-16113 Malicious code in etoro-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP...

Malicious code in etoro-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP...

MAL-2026-16119 Malicious code in etoro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...

Malicious code in etoro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...