CVE-2026-18915

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

EUVD-2026-53819

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915

CVE-2026-18915 affects eta-otp-lock (TÜBİTAK BİLGEM) prior to 1.0.4. The vulnerability is described as a vulnerability where a process can expose visible sensitive information, enabling system footprinting via command-line access. The CVSS 3.1 score is 5.0 (Medium), with local attack vector (AV:L...

CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642

CVE-2026-18642 describes a deserialization of untrusted data vulnerability in TÜBİTAK BİLGEM’s eta-otp-lock (affected: before 1.0.4) that may enable Object Injection. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, NO privileges required, but USER INTERACTION is required; confiden...

CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

EUVD-2026-52294

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Malicious code in esbuild-plugin-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee6c2c46a6a594f389aa85580f033eb39c879f80478d3cca6d746bd8f8afe21 The package esbuild-plugin-eta was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198837

Malicious code in esbuild-plugin-eta npm...

MAL-2025-190840 Malicious code in esbuild-plugin-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee6c2c46a6a594f389aa85580f033eb39c879f80478d3cca6d746bd8f8afe21 The package esbuild-plugin-eta was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-175984

Malicious code in test-theta-old-yaml-eta npm...

EUVD-2025-176479

Malicious code in secure-eta-throw-index-fork npm...

EUVD-2025-179723

Malicious code in class-eta-lambda-hash-root npm...

EUVD-2025-179026

Malicious code in eta-refactor-execute-float-load npm...

EUVD-2025-178447

Malicious code in import-float-omega-user-eta npm...

Malicious code in eta-sed-assert-spy-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba02fba2294b944dedb22735bc1a124430a994c135af1e2b1361494f868a743 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...