Malicious code in @brick-v2/core (npm)

@brick-v2/core is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

MAL-2026-17716 Malicious code in @brick-v2/form (npm)

@brick-v2/form is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)

fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: SNYK:JS-FASTJWT-20825051...

ch.mobi.mobitor:mobitor-base (>=3.1.108, <=3.1.165), com.efluid.oss:efluid-datagate-app (>=1.0.0-beta-21, <=2.1.20) +17 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.11.4)

com.hazelcast:hazelcast MAVEN version 3.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - ch.mobi.mobitor:mobitor-base =3.1.108, =1.0.0-beta-21, =1.0.0-beta-21, =3.0.1-rc, =3.0.0-m3, =2.1.6.release,...

com.avenida.banten:banten-hazelcast (1.0), com.avenida.banten:banten-sample (1.0) +27 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.4.2)

com.hazelcast:hazelcast MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.avenida.banten:banten-hazelcast 1.0 - com.avenida.banten:banten-sample 1.0 - com.bestellensoftware:jsync.io...

co.easimart:vertx-util (1.1.0), com.consol.citrus:citrus-vertx (>=2.7.8, <=2.8.0) +67 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.8.2)

com.hazelcast:hazelcast MAVEN version 3.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - co.easimart:vertx-util 1.1.0 - com.consol.citrus:citrus-vertx =2.7.8, =3.5.0, =1.24.4, =1.24.4, =0.9.6, =2.1.0,...

cn.vertxup:vertx-co (0.5), cn.vertxup:vertx-import (0.5) +37 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.12.1)

com.hazelcast:hazelcast MAVEN version 3.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cn.vertxup:vertx-co 0.5 - cn.vertxup:vertx-import 0.5 - cn.vertxup:vertx-pin 0.5 - cn.vertxup:vertx-rx 0.5 -...

com.corundumstudio.socketio:netty-socketio (2.0.14), com.erudika:para-cache-hazelcast (>=1.41.5, <=1.43.0) +221 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (5.6.0)

com.hazelcast:hazelcast MAVEN version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.corundumstudio.socketio:netty-socketio 2.0.14 - com.erudika:para-cache-hazelcast =1.41.5, =1.8.0, =3.2.3,...

com.bestellensoftware:jsync.io (1.10.2), com.github.dexecutor:dexecutor-hazelcast (1.0.1) +32 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.7)

com.hazelcast:hazelcast MAVEN version 3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.bestellensoftware:jsync.io 1.10.2 - com.github.dexecutor:dexecutor-hazelcast 1.0.1 -...

com.expedia.dsp:circus-train-datasqueeze (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.10, <=0.0.15) +35 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.5.5)

com.hazelcast:hazelcast MAVEN version 3.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.expedia.dsp:circus-train-datasqueeze 1.0 - com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter...

com.erudika:para-server (>=1.25.3, <=1.25.5), com.erudika:para-war (>=1.25.3, <=1.25.5) +24 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.8.4)

com.hazelcast:hazelcast MAVEN version 3.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.erudika:para-server =1.25.3, =1.25.3, =2.2.26, =3.0.0rc1, =3.0.0rc1, =2.2.26, =3.0.0rc1, =3.0.0, =0.5.2,...

cloud.piranha.session:piranha-session-hazelcast (>=19.12.0, <=20.1.2), cn.vertxup:vertx-co (>=0.5.1, <=0.5.4) +81 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.12.4)

com.hazelcast:hazelcast MAVEN version 3.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cloud.piranha.session:piranha-session-hazelcast =19.12.0, =0.5.1, =0.5.1, =0.5.1, =0.5.1, =0.5.1, =0.5.1, =0.5.1...

codes.oss.socketio:netty-socketio (2.0.14), com.erudika:para-cache-hazelcast (>=1.41.3, <=1.41.4) +214 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (5.5.0)

com.hazelcast:hazelcast MAVEN version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - codes.oss.socketio:netty-socketio 2.0.14 - com.erudika:para-cache-hazelcast =1.41.3, =0.12.9, =4.1.0, =1.8.0,...

com.hazelcast:hazelcast-client (3.2.4), com.hazelcast:hazelcast-cloud (3.2.4) +17 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.2.4)

com.hazelcast:hazelcast MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.2.4 - com.hazelcast:hazelcast-cloud 3.2.4 - com.hazelcast:hazelcast-hibernate...

com.bestellensoftware:jsync.io (>=1.10.12, <=1.10.13), com.ecfront.dew:auth (>=1.1.0, <=1.1.4) +24 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.7.5)

com.hazelcast:hazelcast MAVEN version 3.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.bestellensoftware:jsync.io =1.10.12, =1.1.0, =1.0.0, =1.1.0, =1.23.0, =1.0.5, =0.9.2, =0.9.5 -...

voice-agent-tequity (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-107717 via banks (2.2.0)

banks PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on banks and may be impacted: - voice-agent-tequity =0.1.0, =0.1.1 Source cves: CVE-2026-107717 Source advisory: GHSA-HMQ2-7HP6-7CRH...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.10, <=2.0.5), com.gitee.zhan5:starter (1.0.1) +35 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.7.8)

com.hazelcast:hazelcast MAVEN version 3.7.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter =1.0.10, =2.0.5 - com.gitee.zhan5:starter 1.0.1...

com.bucket4j:bucket4j-hazelcast-3 (>=7.6.1, <=8.9.0), com.bucket4j:bucket4j_jdk8-hazelcast-3 (>=8.0.0, <=8.9.0) +34 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.8)

com.hazelcast:hazelcast MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.bucket4j:bucket4j-hazelcast-3 =7.6.1, =8.0.0, =1.24.0, =0.9.0, =0.9.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.0.2,...

cloud.piranha.session:piranha-session-hazelcast (20.12.0), com.bucket4j:bucket4j-hazelcast-4 (>=8.10.0, <=8.10.1) +43 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (4.1)

com.hazelcast:hazelcast MAVEN version 4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cloud.piranha.session:piranha-session-hazelcast 20.12.0 - com.bucket4j:bucket4j-hazelcast-4 =8.10.0, =8.11.0,...

com.bestellensoftware:jsync.io (1.8.6-alpha-2), com.hazelcast:hazelcast-build-utils (3.4.4) +9 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.4.4)

com.hazelcast:hazelcast MAVEN version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.bestellensoftware:jsync.io 1.8.6-alpha-2 - com.hazelcast:hazelcast-build-utils 3.4.4 -...