Malicious code in yazxzpedia-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a15db837581bcddfd86653905bef2911ba017a109d3275551bb040e60b61794 The package yazxzpedia-libsignal was found to contain malicious code. Source: ghsa-malware...

Malicious code in @sanzxcode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15bab1682cf8fc2aaa7d7f45b24bd1bf279b1e823e8f1c59f6def120297bccc0 The package @sanzxcode/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1102 Malicious code in bcryptance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed37cfda6ab978a2daf87bc62162281d76b374965332f7a53cd4c3166db1f665 The package bcryptance was found to contain malicious code. Source: ghsa-malware 66b3b4f916ff12920a8d6b8dd76d567166e62a5592ae3a107d7aaa15fc96fe17 Any...

PT-2026-29607

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4 Description When following redirects to a different origin, aiohttp removes the Authorization header while keeping the Cookie and Proxy-Authorization headers. This could lead to the leakage of sensitive...

MAL-2026-1010 Malicious code in modify-setting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48505e42b99b10152a5e8587fc88350de886a6ff02ca5b70ada3d90c9a7e980f The package modify-setting was found to contain malicious code. Source: ghsa-malware 3420a3d9050f94ba247ff8853e7a7f98ee33ca16a7beda959c53463992b65c24...

Malicious code in iruchache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89a5662924927fa4f51ea9338e9e71722d8554754b9c6a42d20651fbf209ed1 The package iruchache was found to contain malicious code. Source: ghsa-malware b44470c4008c04639889f53b9b4ab430335013659859007be3c55f551d2d68a9 Any...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via system.run. An attacker can bypass allowlist enforcement and approval prompts by supplying an allowlisted rawCommand while providing a different command argume...

MAL-2026-895 Malicious code in json-mapping-src (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc958aaacb5ea616283510ccda98b0a4634c35d348eece1613366ac66ad41abb The package json-mapping-src was found to contain malicious code. Source: ghsa-malware 8e7f8a61a6a361880bea88321b1f130627266e5f1d54e8aa9d9f47d64c99db...

CVE-2025-0031

A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLESOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity...

Malicious code in chai-as-approved (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f623e45c7742d5a9190e736f51777bae77297d5abeafd8c21679bd40b729034b The package chai-as-approved was found to contain malicious code. Source: ghsa-malware da0fdbfe00f6e097edd25bc90bfbac03e97c871951995b5d58f06b348d39c8...

PT-2026-7445

A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE SOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity...

CVE-2026-24776

OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag handler moving an agenda item to a different section was not properly checking if the target meeting section is part of the same meeting or is the backlog, in case of recurring meetings. This allowed a...

MAL-2026-756 Malicious code in cat-retail-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28595a83aef3c3c9726d6ab0fc4b4d761a0a0c9f12ac91d4d84bda7135d46786 The package cat-retail-app was found to contain malicious code. Source: ghsa-malware b05f145df7999baec69425a057fe9a33c6a65726ca898c89b80cb23526f54bae...

MAL-2026-709 Malicious code in mongooose_update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0077f550d3b03f4fbc6ea54a833c0e5e80aba58bec307a6720065e7d08fafd12 The package mongoooseupdate was found to contain malicious code. Source: ghsa-malware f8f7054ae7149c28576adb91e81dabf2d46ed622ff6cb5d7ae81fec89a6d027...

MAL-2026-666 Malicious code in transform-react-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad21ba0cb042f576642dd61d0639ac6da6cec5a468ff7b5cf0aab9164667bcb0 The package transform-react-display-name was found to contain malicious code. Source: ghsa-malware...

Malicious code in yazxzpedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f94694d3882914e6f75cc35db5533b7d7c4d9caebb2631033de332d3c49e562 The package yazxzpedia was found to contain malicious code. Source: ghsa-malware e97d515edc36ba99b0d5fa4cc5cd35798ff96229f05a9f93ba6dbef0631f1ac0 Any...

Malicious code in researchpoc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 543f158149a74f451a6b81f0c088ec8bcfbfb019477a57c17c44da8e58e2df3d The package researchpoc2 was found to contain malicious code. Source: ghsa-malware f4dc24e7a14111cc2df68f08d7e66d1493e2c98b12d547140775f16bfe49f56c A...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Prevent tail calls between programs attached to different hooks Programs progs can be attached to kernel functions, and these attached functions may take different parameters or return different return values. If a program...

Malicious code in ftm-noderpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48bffc97a9e30f15aaeea633df39ff0ab500a8f4aeee9757390e0d0e2393e9d9 The package ftm-noderpc was found to contain malicious code. Source: ghsa-malware b2c3dc311c3d101881ee473edd9232f94c95686770a45f681038070507407fc2 An...

MAL-2026-525 Malicious code in sandbox-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de188418d12a5397810d78eeeb5b8e939a4fc430f8c2aa3113e7fa3a5360e2c8 The package sandbox-hooks was found to contain malicious code. Source: ghsa-malware 7d12de65eeb03f7f648a293f5f7217cce1215878610d2bf4f973cd510733eedb...