Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

GHSA-FQ3F-M5QM-99F5

creationtimestamp| type| source ---|---|--- 2026-07-29 20:31:26+00:00| seen| https://gist.github.com/alon710/e40fc20ed683aaeeae74fc5b1a713445...

GHSA-5QJQ-93H5-HRGP vulnerabilities

Vulnerabilities for packages: litellm, open-webui...

GHSA-5XF7-4P34-54QR vulnerabilities

Vulnerabilities for packages: litellm, open-webui...

CVE-2026-54660

creationtimestamp| type| source ---|---|--- 2026-07-29 16:35:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrse6yre5z2p 2026-07-29 16:35:25+00:00| published-proof-of-concept| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-h754-fxp7-88wx...

GHSA-4P3G-4HCJ-WPVX

creationtimestamp| type| source ---|---|--- 2026-07-29 16:32:11+00:00| seen| https://gist.github.com/alon710/fffec7ff7a3f093df17d5e871ff03c84...

GHSA-W9VV-Q986-VJ7X

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:06+00:00| seen| https://t.me/hnbestcomments/30331 2026-07-30 00:01:46+00:00| seen| https://t.me/hnbestcomments/30331 2026-08-01 08:00:05+00:00| seen| https://t.me/hnbestcomments/30331 2026-08-02 00:01:12+00:00| seen|...

GHSA-8359-H9FX-J6V9

creationtimestamp| type| source ---|---|--- 2026-07-29 10:31:22+00:00| seen| https://gist.github.com/alon710/d0f3f961aeff39e79a8edafcd7786784...

Malicious code in zer0code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f11a39a2be94308e553081d26ba71cf416858053c84e52674666ba6f4acbf0f Package ships Python files under skills/pentesting.py and tools/security/exploit.py that reference ping commands and shell-spawning primitives...

GHSA-25RX-86V8-32C6 vulnerabilities

Vulnerabilities for packages: eco-python-curl...

GHSA-VW2X-3W8J-RQ82 vulnerabilities

Vulnerabilities for packages: eco-python-curl...

GHSA-XQ9P-GXG6-F7Q6 vulnerabilities

Vulnerabilities for packages: eco-python-curl...

GHSA-JR4F-4564-W3MR vulnerabilities

Vulnerabilities for packages: eco-python-curl...

EUVD-2026-50080

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...

GHSA-V8VM-CQH8-Q87Q

creationtimestamp| type| source ---|---|--- 2026-07-28 21:31:27+00:00| seen| https://gist.github.com/alon710/f64be2d49b2d7a1297c03bef66babfa4...

GHSA-H72J-P4F7-VRCJ vulnerabilities

Vulnerabilities for packages: linux-gcp...

GHSA-3FXJ-6JH8-HVHX vulnerabilities

Vulnerabilities for packages: karma, telegraf, fluxcd-kustomize-mutating-webhook...

GHSA-9G5Q-2W5X-HMXF vulnerabilities

Vulnerabilities for packages: karma, telegraf, fluxcd-kustomize-mutating-webhook...

GHSA-PGGX-2V9R-J6GM vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-R28C-9Q8G-F849 vulnerabilities

Vulnerabilities for packages: pelias-api, authentik-fips, keep, keep-fips, authentik, jitsucom-jitsu, langfuse, semaphore, cadence-web, homepage, nextcloud-server, unleash, langfuse-fips, vitess, arangodb, unleash-fips, librechat...