MAL-2026-6562 Malicious code in @epic-common/observability-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73d7457ccefffe2de1f0464f21ac2eadfb981be593d2b34ceb0d5cde1174da0b Package targets the private @epic-common scope Epic Games and is published to the public npm registry as a dependency-confusion vehicle. On import of...

Malicious code in yandex-geobase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6219d513896736aee31ce33719d6ae2d1f5b03293ecdfe884d944bbb3eb99a [email protected] squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTTP GET to a hardcoded bare-...

MAL-2026-6574 Malicious code in yandex-geobase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6219d513896736aee31ce33719d6ae2d1f5b03293ecdfe884d944bbb3eb99a [email protected] squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTTP GET to a hardcoded bare-...

MAL-2026-6571 Malicious code in react-wp-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 443f37b7957fe3f1d4dd836b3a0e6eeddb513e334700e0c0a4616570071c13d8 react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP endpoint at...

Malicious code in react-wp-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 443f37b7957fe3f1d4dd836b3a0e6eeddb513e334700e0c0a4616570071c13d8 react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP endpoint at...

MAL-2026-6567 Malicious code in eslint-commit-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc51e200a141d1dbbb4f7eb9e5e3dec18507572e5dc9562278713c554fad195 The package is published under the name eslint-commit-parser but its contents are a verbatim copy of the supertest HTTP-testing library — package.jso...

MAL-2026-6572 Malicious code in rebrandly-domains-digger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1744d2a299b9ef0526f49b4b2297fcd6c72581c51a3359801db56318d8cfda The package declares a preinstall hook that runs node callback.js. On npm install, callback.js collects installer-side identifiers — os.hostname,...

MAL-2026-6573 Malicious code in rebrandly-domains-search-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4464320c8530d582d35f85ce95045182d82e1dd63a830644bcb68f05bdf10e Package [email protected] is an empty module index.js exports an empty object whose package.json preinstall hook runs node...

redis-type-xyz (2.1.1) potentially affected by unknown CVE via ulid-xyz (3.2.4)

ulid-xyz NPM version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on ulid-xyz and may be impacted: - redis-type-xyz 2.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-6672...

FreeBSD : DNSdist -- vulnerabilities (6c0e17cf-73a0-11f1-910d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6c0e17cf-73a0-11f1-910d-3c7c3fba4204 advisory. The DNSdist team reports: Thanks to people below for reporting these vulnerabilities. Tenable...

@mseep/easy-notion-mcp (1.0.1), ioredis-xyz (5.11.2) +1 more potentially affected by unknown CVE via ulid-xyz (2.12.3)

ulid-xyz NPM version 2.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on ulid-xyz and may be impacted: - @mseep/easy-notion-mcp 1.0.1 - ioredis-xyz 5.11.2 - redis-type-xyz 1.10.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-6672...

hermes-next (>=0.1.0, <=0.7.1), openviking-curator (0.7.0) +1 more potentially affected by CVE-2026-13507 via openviking (>=0.3.24, <=0.4.13)

openviking PYPI version =0.3.24, =0.1.0, =0.7.1 - openviking-curator 0.7.0 - vikingbot 0.1.3 Source cves: CVE-2026-13507 Source advisory: SNYK:PYTHON-OPENVIKING-17751095...

khoj-assistant (>=1.21.0, <=1.21.1) potentially affected by CVE-2026-13508 via khoj (1.42.10)

khoj PYPI version 1.42.10 is affected by a known vulnerability. The following packages have a transitive dependency on khoj and may be impacted: - khoj-assistant =1.21.0, =1.21.1 Source cves: CVE-2026-13508 Source advisory: SNYK:PYTHON-KHOJ-17756762...

@bishk029/agent-smith (>=0.1.0, <=2.0.1), ai-ad-generator (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-13511 via @voltagent/server-hono (>=1.2.11, <=2.0.14)

@voltagent/server-hono NPM version =1.2.11, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2026-13511 Source advisory: SNYK:JS-VOLTAGENTSERVERHONO-17875092...

@bishk029/agent-smith (>=0.1.0, <=2.0.1) potentially affected by CVE-2026-13511 via @voltagent/serverless-hono (2.0.12)

@voltagent/serverless-hono NPM version 2.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on @voltagent/serverless-hono and may be impacted: - @bishk029/agent-smith =0.1.0, =2.0.1 Source cves: CVE-2026-13511 Source advisory:...

@bishk029/agent-smith (>=0.1.0, <=2.0.1), @voltagent/server-elysia (>=2.0.0, <=3.0.0-next.0) +3 more potentially affected by CVE-2026-13511 via @voltagent/server-core (>=1.0.0-next.1, <=3.0.0-next.0)

@voltagent/server-core NPM version =1.0.0-next.1, =0.1.0, =2.0.0, =1.0.0-next.1, =1.0.1, =0.1.0, =0.1.1 Source cves: CVE-2026-13511 Source advisory: SNYK:JS-VOLTAGENTSERVERCORE-17875090...

Malicious code in skillspector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877 This package presents itself as a redistribution of NVIDIA/skillspector pyproject Homepage points to github.com/NVIDIA/skillspector and the source...

MAL-2026-6561 Malicious code in skillspector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877 This package presents itself as a redistribution of NVIDIA/skillspector pyproject Homepage points to github.com/NVIDIA/skillspector and the source...

airflow-provider-skypilot (0.1.3), autodistill-efficient-yolo-world (>=0.1.0, <=0.1.1) +28 more potentially affected by CVE-2026-13482 via skypilot (>=0.2.2, <=0.13.0)

skypilot PYPI version =0.2.2, =0.1.0, =0.1.2.dev0, =0.1.4, =0.12.0, =0.1.4, =0.1.1, =0.9.9, =0.9.9rc23, =0.9.9rc23, =0.9.9, =0.9.9, =1.0.2, =0.1.0, =0.12.1 and more Source cves: CVE-2026-13482 Source advisory: SNYK:PYTHON-SKYPILOT-17675441...

ai.timefold.solver:timefold-solver-migration (>=0.8.38, <=1.5.0), ai.tripl:arc-deltalake-pipeline-plugin_2.11 (>=1.2.0, <=1.6.0) +2812 more potentially affected by CVE-2026-13500 via org.antlr:antlr4 (>=4.0, <=4.13.2)

org.antlr:antlr4 MAVEN version =4.0, =0.8.38, =1.2.0, =1.2.0, =1.0.0-alpha01, =1.0.0-alpha1, =1.1.0-alpha02, =1.0.0-alpha01, =3.2.0-alpha12, =3.2.0-alpha12, =2.4.0-alpha01, =2.4.0-alpha01, =2.0.0-rc02, =2.0.0-alpha1, =2.2.6 and more Source cves: CVE-2026-13500 Source advisory:...