Security update for hauler (moderate)

openSUSE security update: security update for hauler ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20662-1 Rating: moderate References: bsc1258614 Cross-References: CVE-2026-24122 CVSS scores: CVE-2026-24122 SUSE : 3.7...

Malicious code in rostilesolver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 eef0922e5bb8ba3371baad4b76542215ff15e445a9d6ed6fb5546230fe5da4df During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-3250 Malicious code in rostilesolver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 eef0922e5bb8ba3371baad4b76542215ff15e445a9d6ed6fb5546230fe5da4df During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

@aaasd/pocpoc (99.99.9996), internal-company-module-test-1337 (>=99.99.9991, <=99.99.9995) potentially affected by unknown CVE via internal-company-module-test-1337 (99.99.9996)

internal-company-module-test-1337 NPM version 99.99.9996 is affected by a known vulnerability. The following packages have a transitive dependency on internal-company-module-test-1337 and may be impacted: - @aaasd/pocpoc 99.99.9996 - internal-company-module-test-1337 =99.99.9991, =99.99.9995 Sour...

actix-casbin (>=0.4.0, <=1.1.0), actix-casbin-auth (>=0.4.0, <=1.1.0) +675 more potentially affected by unknown CVE via smartstring (>=0.2.7, <=1.0.1)

smartstring CARGO version =0.2.7, =0.4.0, =0.4.0, =0.3.5, =0.1.4, =0.0.2, =0.0.3, =0.0.10, =0.1.3, =0.1.0, =0.2.0, =0.2.0, =0.8.0, =0.8.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0249...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +997 more potentially affected by unknown CVE via im (>=9.0.0, <=15.1.0)

im CARGO version =9.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.0.5, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =0.0.1, =0.0.1, =0.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0248...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +1204 more potentially affected by unknown CVE via bitmaps (>=2.1.0, <=3.2.1)

bitmaps CARGO version =2.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.0-alpha, =0.0.1-alpha.1, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0247...

aper (>=0.2.0, <=0.3.0), aper-stateroom (0.3.0) +209 more potentially affected by unknown CVE via im-rc (>=12.3.4, <=15.1.0)

im-rc CARGO version =12.3.4, =0.2.0, =0.3.3, =0.1.0, =0.1.0, =1.0.0, =2.0.0 - bytebraise 0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0250...

xhci (>=0.2.6, <=0.9.2) potentially affected by unknown CVE via accessor (>=0.2.0, <=0.3.3)

accessor CARGO version =0.2.0, =0.2.6, =0.9.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0127...

rustdx-cmd (>=0.1.0, <=0.3.0) potentially affected by unknown CVE via rustdx (>=0.2.5, <=0.3.0)

rustdx CARGO version =0.2.5, =0.1.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0123...

Malicious code in apexomni-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 497dca02206d8084e5a7e135245489a5ef9dd03f318b138574bc43386ddac0ef During installation, multiple sensitive environment variables are being exfiltrated. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-3235 Malicious code in apexomni-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 497dca02206d8084e5a7e135245489a5ef9dd03f318b138574bc43386ddac0ef During installation, multiple sensitive environment variables are being exfiltrated. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in graphicctx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8867133b18f35132bf0096bdbd5d1891e87f8a07bbba09f6dffe21c8b048596e Packages in this campaign are used to exfiltrate data from users installing code from prepared Github repositories. Packages contain code to exfiltrate files...

MAL-2026-3224 Malicious code in graphicctx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8867133b18f35132bf0096bdbd5d1891e87f8a07bbba09f6dffe21c8b048596e Packages in this campaign are used to exfiltrate data from users installing code from prepared Github repositories. Packages contain code to exfiltrate files...

Malicious code in py-clob-clients (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7136140b365c314a42f5efe300779f093c40a41fb5c2258c7f5ff05c88eba2f8 Package exfiltrates env variables from .env files. It's a typosquatting of a legitimate package and is used in a malicious GitHub repository --- Category:...

Malicious code in tns-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 186bfba0931ba063bd6e71325785b97c646cbfaaf91c4dca876653673d29c0cc Package is prepared to exfiltrate environmental variables. The wording used clearly states it's part of a campaign targeting cryptocurrency users via malicious...

MAL-2026-3219 Malicious code in tns-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 186bfba0931ba063bd6e71325785b97c646cbfaaf91c4dca876653673d29c0cc Package is prepared to exfiltrate environmental variables. The wording used clearly states it's part of a campaign targeting cryptocurrency users via malicious...

0xble (>=14.0.0, <=21.9.1), 100xchat (>=1.1.5, <=1.3.5) +4478 more potentially affected by CVE-2026-8656 via jsondiffpatch (>=0.0.11, <=0.7.3)

jsondiffpatch NPM version =0.0.11, =14.0.0, =1.1.5, =1.0.0, =1.0.0, =1.0.4, =0.10.6, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.1, =0.1.0-alpha.1, =0.1.0, =0.3.1, =0.5.10, =1.2.4 and more Source cves: CVE-2026-8656 Source advisory: SNYK:JS-JSONDIFFPATCH-1663594...

MAL-2026-3214 Malicious code in renderkitcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a66bf58bff553ec613604164eb60adcb89fcde468491b746838a6e2c18b0e3a0 Package is prepared to exfiltrate .log and .txt files to the target already associated with exfiltrating sensitive data. --- Category: MALICIOUS - The campaign...

Malicious code in renderkitcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a66bf58bff553ec613604164eb60adcb89fcde468491b746838a6e2c18b0e3a0 Package is prepared to exfiltrate .log and .txt files to the target already associated with exfiltrating sensitive data. --- Category: MALICIOUS - The campaign...