contra-rotor (0.1.0), etl-server (>=0.0.6, <=0.0.7) potentially affected by CVE-2026-82355 via apache-airflow (1.10.13)

apache-airflow PYPI version 1.10.13 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - contra-rotor 0.1.0 - etl-server =0.0.6, =0.0.7 Source cves: CVE-2026-82355 Source advisory: OSV:PYSEC-2026-3989...

airflow-clickhouse-plugin (1.4.0), dataflow-airflow (>=2.10.5, <=2.10.10) +15 more potentially affected by CVE-2026-82355 via apache-airflow (2.10.5)

apache-airflow PYPI version 2.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.4.0 - dataflow-airflow =2.10.5, =1.7.15, =1.8.0rc2, =5.1.0, =1.4.23, =0.21.6, =1.6.35, =1.23.18, =1.19....

contra-rotor (0.1.0), etl-server (>=0.0.6, <=0.0.7) potentially affected by CVE-2026-75158 via apache-airflow (1.10.13)

apache-airflow PYPI version 1.10.13 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - contra-rotor 0.1.0 - etl-server =0.0.6, =0.0.7 Source cves: CVE-2026-75158 Source advisory: OSV:PYSEC-2026-3988...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-75158 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-75158 Source advisory: OSV:PYSEC-2026-3988...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in uuid

Summary Security Bulletin:Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in uuid, IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), be.eliwan:eoddata-client (1.0) +2304 more potentially affected by CVE-2026-91866 via org.apache.neethi:neethi (>=3.0.0, <=3.2.3)

org.apache.neethi:neethi MAVEN version =3.0.0, =1.9.0, =1.1.7, =1.1.9, =1.2.5, =3.00.4, =3.00.3, =4.00.10, =11.4-37, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2026-91866 Source advisory: SNYK:JAVA-ORGAPACHENEETHI-20159010...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), be.eliwan:eoddata-client (1.0) +2304 more potentially affected by CVE-2026-91864 via org.apache.neethi:neethi (>=3.0.0, <=3.2.3)

org.apache.neethi:neethi MAVEN version =3.0.0, =1.9.0, =1.1.7, =1.1.9, =1.2.5, =3.00.4, =3.00.3, =4.00.10, =11.4-37, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2026-91864 Source advisory: MEND:CVE-2026-91864...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), be.eliwan:eoddata-client (1.0) +2304 more potentially affected by CVE-2026-91863 via org.apache.neethi:neethi (>=3.0.0, <=3.2.3)

org.apache.neethi:neethi MAVEN version =3.0.0, =1.9.0, =1.1.7, =1.1.9, =1.2.5, =3.00.4, =3.00.3, =4.00.10, =11.4-37, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2026-91863 Source advisory: MEND:CVE-2026-91863...

Malicious code in keroeltopkk (npm)

Source: amazon-inspector b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc Package [email protected] ships only a manifest and a beacon script server.js and wires it into every npm lifecycle hook preinstall/install/postinstall/prepare, so npm install auto-executes it. server.js...

Malicious code in byted-commerce-materials (npm)

Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collects hostname, username, platform, cwd, home directory,...

Malicious code in @siriusbeyond/auth (npm)

Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install. callback.js collects installer host identifiers hostname, username...

Malicious code in keroeltopgg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b4e331f9f02f436e01e5c7696088d12ea3237af7fbe54fd37ec37e786c960d [email protected] is a stub package whose index.js, executed on require/import, reads os.hostname and issues an HTTPS GET to the hardcoded collect...

MAL-2026-16336 Malicious code in keroeltopkkk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2758c1a2619db534fdc8e2981e051769b20641492d12ff984e333446e0c734e3 The package ships a single server.js that is wired into every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

Malicious code in test1ro (npm)

Source: amazon-inspector 8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e package.json declares preinstall and postinstall hooks that run node index.js, which reads os.hostname and issues an HTTP GET to the hardcoded third-party collector http://eo8f3m3ho26a0nm.m.pipedream.net/?h=...

Malicious code in chat-adapter-matrix (npm)

Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare, postprepare and from the main module. server.js issues an HTTP...

Malicious code in test1gg234 (npm)

Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare IP 128.199.122.145 with the package name in the query strin...

MAL-2026-16322 Malicious code in @siriusbeyond/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...

Malicious code in @siriusbeyond/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...

MAL-2026-16319 Malicious code in @dbbhk/ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...

Malicious code in test1sdsd2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7bd7c5932337e17adaf4900cb7e29766fe6b5307bd170b38660dd05497ebdc Package [email protected] declares preinstall and postinstall hooks in package.json that execute index.js on npm install. index.js performs an HTTP...