Malicious code in test89078-auth (npm)

Source: amazon-inspector c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573 The package's preinstall script scripts.preinstall = 'node index.js' runs automatically on npm install and collects os.userInfo.username and os.hostname, then issues a dns.lookup against a subdomain of...

MAL-2026-16271 Malicious code in test89078-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573 The package's preinstall script scripts.preinstall = 'node index.js' runs automatically on npm install and collects os.userInfo.username and...

Malicious code in ppb-manticore (npm)

Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward through parent directories to read the enclosing project'...

Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with dependency-confusion targeting an organization's internal registry...

CVE-2026-68558: Server-Side Request Forgery (SSRF)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

Malicious code in cewe-npm-cops (npm)

Source: amazon-inspector 673bd57ca8632e768772381c7439b0b15008914879dfb5c22d42e40ce954c9e5 [email protected] is a dependency-confusion probe. package.json declares scripts.preinstall = 'node preinstall.js'; preinstall.js reads os.hostname and issues a dns.lookup against...

CLSA-2026-1783676351 nodejs: Fix of 4 CVEs

CVE-2026-48930: reject hostnames with embedded NUL bytes in dns.lookup and net.connect to prevent silent authority rebinding - CVE-2026-48619: cap the HTTP/2 client ORIGIN set size to prevent unbounded memory growth - CVE-2026-48618: normalize hostname to ASCII for TLS server identity checks -...

CLSA-2026-1783675292 nodejs: Fix of 4 CVEs

CVE-2026-48930: reject hostnames with embedded NUL bytes in dns.lookup and net.connect to prevent silent authority rebinding - CVE-2026-48619: cap the HTTP/2 client ORIGIN set size to prevent unbounded memory growth - CVE-2026-48618: normalize hostname to ASCII for TLS server identity checks -...