MAL-2026-12526 Malicious code in cards-forms-clone-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4 On require, index.js loads bootstrap.js which reconstructs endpoint hostnames from split string fragments assembling .workers.dev hosts such as...

Malicious code in cards-forms-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf698916c071bb43228f0e40bbb5fc10c2c35c495e091c0b3d1cf1c10e8eb26 On require'cards-forms-credit-clone', index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare workers.dev host...

MAL-2026-12527 Malicious code in cards-forms-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf698916c071bb43228f0e40bbb5fc10c2c35c495e091c0b3d1cf1c10e8eb26 On require'cards-forms-credit-clone', index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare workers.dev host...

Malicious code in cards-forms-clone-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74486d1afedd40c87c6d604f98ffda15100b2ee63af56e8f7330346d915269c9 On require, index.js loads platform.js, which selects a platform-specific asset URL from obfuscated hostnames assembled via split-then-join string...

MAL-2026-12524 Malicious code in cards-forms-clone-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74486d1afedd40c87c6d604f98ffda15100b2ee63af56e8f7330346d915269c9 On require, index.js loads platform.js, which selects a platform-specific asset URL from obfuscated hostnames assembled via split-then-join string...

Malicious code in cards-forms-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime b...

MAL-2026-12528 Malicious code in cards-forms-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime b...

Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

MAL-2026-12525 Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

MAL-2026-12523 Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

CVE-2026-67623

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

vuln-agent

vuln-agent AI-powered vulnerability scanner + exploit-researc...

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control C2 technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two...

CVE-2026-67623 Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

CVE-2026-67623

Technical details about CVE-2026-67623 are not publicly available in the provided documents. No vendor, product versions, affected components, or remediation are specified here. Monitor for updates in future connected documents.

CVE-2026-67623 Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

CVE-2026-67623 Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

EUVD-2026-53342

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

CVE-2026-71284

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...