Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain...

MAL-2026-18462 Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered...

Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1 The gem declares ext/mkrfconf.rb as an extension script, so it runs automatically on gem install. The script collects host reconnaissance data...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6158 more potentially affected by CVE-2026-93567 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93567 Source advisory: MEND:CVE-2026-93567...

Malicious code in astar-e2e-tests (npm)

Source: ossf-package-analysis 9c7d3b2f90649e2315bacb152ef9917066857fd46b3240dca8dfa09ae075df60 The OpenSSF Package Analysis project identified 'astar-e2e-tests' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5923 more potentially affected by CVE-2026-59921 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-59921 Source advisory: SNYK:JAVA-IONETTY-18231070...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5923 more potentially affected by CVE-2026-59898 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-59898 Source advisory: OSV:GHSA-4MP9-239F-G9HG...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5923 more potentially affected by CVE-2026-56746 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-56746 Source advisory: GHSA-6CQP-G7GG-8HR5...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.7.4) +1211 more potentially affected by CVE-2026-34487 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.7.5 and more Source cves: CVE-2026-34487 Source advisory: MEND:CVE-2026-34487...

GHSA-W7J5-J98M-W679 OpenClaw has multiple E2E/test Dockerfiles that run all processes as root

Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 root. If any process is compromised, the attacker has root inside the container, making container breakout significantly easier. Partial fix 2026-02-08: Commit 28e1a65e added USER sandb...

Malware in compass-e2e-tests

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-922 Malicious code in compass-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27a245065291bd7252411254769a1764aab8e228c8ca161708734a3d47d3c9ec The package compass-e2e-tests was found to contain malicious code. Source: ghsa-malware...

Malicious code in compass-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27a245065291bd7252411254769a1764aab8e228c8ca161708734a3d47d3c9ec The package compass-e2e-tests was found to contain malicious code. Source: ghsa-malware...

OPENSUSE-SU-2025:0003-1 Security update for etcd

This update for etcd fixes the following issues: Update to version 3.5.12: Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 test: fix TestHashKVWhenCompacting: ensure all goroutine finished print error log when creating peer listener failed mvcc: Printing etcd backend database related...

MAL-2024-11775 Malicious code in plugin-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 94f214fcdbb802ff7c5fc8a5ed3a9b6beadad35c781b93af7a7f4465020fe333 The OpenSSF Package Analysis project identified 'plugin-e2e-tests' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in astar-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9c7d3b2f90649e2315bacb152ef9917066857fd46b3240dca8dfa09ae075df60 The OpenSSF Package Analysis project identified 'astar-e2e-tests' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Moderate: Red Hat Security Advisory: RHSA: Submariner 0.14 - bug fix and security updates

Submariner 0.14 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.7 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS...

MAL-2022-5244 Malicious code in paypal-sdk-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbf78f6e3c0804dd208733f5a6a2c666614467a873d68214580d2f183b1dc35f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in paypal-sdk-e2e-tests

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

kubernetes security update

1.9.1-2.1.5 - Production built 1.9.1-2.1.5 - Fix the upgrade version check - Remove w/a from Orabug 27125915 1.9.1-2.1.4.dev - Make sure worker node upgrade properly - Orabug 27649898 1.9.1-2.1.3.dev - Ensure that the runtime mounts RO volumes read-only CVE-2017-1002102 - Update Dashboard version...