Malicious code in brlc-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4e1d5bf92d7953e1333f3d575ad749dc56b9914ae64813b2e9753a0718a2882 The package brlc-base was found to contain malicious code. Source: ghsa-malware c50e966389745dbbf1f8c81e6b0e19db8d01502091437c4148cde8991e9e314d Any...

MAL-2026-1400 Malicious code in solana-pumpfun-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25b5c167c097f41d490f55b16ad2263c163b7afb898528dafb13a74f513b9181 The package solana-pumpfun-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1390 Malicious code in @depro-tech/cortana-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ab02cdce682fe76e6709fc00a3df615b366f38ed30270f635ddca7b122275fc The package @depro-tech/cortana-md was found to contain malicious code. Source: ghsa-malware...

Malicious code in dell-emc-internal-api-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b1c68a3106c50c73d1ede904d8c6fe7b41466a0e619e50c0935a7988293740 The package dell-emc-internal-api-drzak was found to contain malicious code. Source: ghsa-malware...

Malicious code in @kinggupong/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3aec3e6bd7152f810947ba89be8ccb87de340b49801eef6c91c2a809330dfb03 The package @kinggupong/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1358 Malicious code in dappa-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1eeaec0511dd790f563abdf59568e7aa14de6e21c4c8f2b44f0b636098f54b The package dappa-libsignal was found to contain malicious code. Source: ghsa-malware 23e35315c10b6b42c517deeb17e10e7bdbeafc3562268eca0d6758a23e31ea6...

MAL-2026-1337 Malicious code in typescript-urql (npm)

The package 'typescript-urql' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1300 Malicious code in @mmm-otrade/transaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f1e04f746cfc3e1e936e4a628b0435b494c9dfc00739285e88d0ae03b00d9b3 The package @mmm-otrade/transaction was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1309 Malicious code in iron-localstorage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b4370af9c8f0db5604f7bc2648c64054140ea6fbcfebd4eef181c7330efaf77 The package iron-localstorage was found to contain malicious code. Source: ghsa-malware...

Malicious code in @shenira/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3952357e13678bb1abb18600854c622a3c5596cff93e8cc3ba309a6f51fccb1f The package @shenira/baileys was found to contain malicious code. Source: ghsa-malware a2914e7416552719c1008f077553702efc5d7710bc760aa34eeaeede86535b...

MAL-2026-1245 Malicious code in nf-referral-backend-placeholder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44ad77b1a6ac52b4914c8516043f3f52e27f4a328b2940bf5b4d9c63e66662b2 The package nf-referral-backend-placeholder was found to contain malicious code. Source: ghsa-malware...

GHSA-534W-2VM4-89XR OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

A missing group-sender authorization check in the Zalo plugin allowed unauthorized GROUP messages to enter agent dispatch paths in configurations intended to restrict group traffic. Impact When Zalo group handling was configured with allowlist-style controls, a sender not present in the intended...

OpenClaw has Canvas route hardening for mixed-trust deployments

Summary This advisory tracks a defense-in-depth hardening for canvas routes. In mixed-trust or network-visible deployments, prior canvas auth/fallback behavior could broaden access beyond intended boundaries. Deployment Context OpenClaw’s default model is trusted host + loopback-first access. Som...

Malicious code in demo-pipelinetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cdbe67e8fa0e92aa8f588916bbaf7b0c041cd6613636172f671c1a6251df15e The package demo-pipelinetest was found to contain malicious code. Source: ghsa-malware...

BIT-DISCOURSE-2026-28218 Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12....

MAL-2026-1192 Malicious code in chai-as-proofed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f83db1fa5312f0e34beebb192fb972f2d0e88650b49945571b438d27156de06 The package chai-as-proofed was found to contain malicious code. Source: ghsa-malware b69ea2b92d530f84e379af75eaaefcf70c71f603a5bb307eb7e658b4b290db8...

Malicious code in demo-ip-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f9378de5524843952c850c47aae7cc5373145c2b41032b764da720e9a0656f The package demo-ip-package was found to contain malicious code. Source: ghsa-malware 9377708b245cac5b751ac6dc75d9218b993bcb4cebed6f2049a542868f5df31...

MAL-2026-1197 Malicious code in demo-ip-package-cm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 756fbc97ea8b65830898805513bede65c955e6ae300a4d19574e984d17615b37 The package demo-ip-package-cm was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1174 Malicious code in ethersnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05646d5daf39bd4f36dd32267c3f5428b8eeb3913781b2c8549594679dafac3b The package ethersnode was found to contain malicious code. Source: ghsa-malware 839839d225447c7bde56628923d8e812808862fdda069eb93df578a04cc25525 Any...

Malicious code in webnoch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f045d0850d50727da82888da15d6620d9328a2369899f721d607f1f4c403a5 The package webnoch was found to contain malicious code. Source: ghsa-malware 2a2b9fe8fd000b219aa46666ba8162fd132a3a15a5e0431d3c87c48b8c674eef Any...