36492 matches found
Malicious code in @antv/l7-editor (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/gi-assets-tugraph (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/gi-assets-algorithm (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/gi-assets-galaxybase (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-webgpu-unitchart (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-webgpu-compiler (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in autoheal-dev-cli (npm)
Source: amazon-inspector 6e0f114cd638df1be1f2262e1b05dbe726cee5600a10be6d67be8ac8e1089f3d autoheal-dev-cli is a setup wizard bin/setup.js that, when run, performs three installer-harm actions against the developer running it: 1 syncConfigToServer POSTs the user's GitHub Personal Access Token with...
Malicious code in @vino.tian/vibe-kanban (npm)
Source: amazon-inspector 7f1533bb7e55b1bcd10291aa9f19e2a5cbe5755a7a6a7343d38fbd3ff8064a1f This package is published as @vino.tian/vibe-kanban and copies its README, name, and feature description from BloopAI's legitimate vibe-kanban project, but its binary distribution channel is a different,...
Malicious code in @autoheal/setup (npm)
Source: amazon-inspector 3a8b8b7d51e8865d048583893b08ad3d3d95a8371963b82adc6bf4b7938fe4c1 When the user runs this setup wizard, bin/setup.js posts the user's GitHub Personal Access Token scope repo,user:email, GitHub repo name, branch, Vercel deploy hook, and N8N webhook URL to a hardcoded...
Malicious code in o3forms (npm)
Source: amazon-inspector 4d094d4429f1492bb6b99d802de86b97dc972e06d680a1287846e6d1635fe457 The package name impersonates the OpenMRS O3 forms ecosystem legitimate packages are published under the @openmrs/ scope. package.json declares an optionalDependency o3forms-utils resolved as...
Malicious code in goreleaser-run (npm)
Source: amazon-inspector f2733e0c086915d44eb8c971575087d9260bf1133d62da63920b578cf7e60c30 Package impersonates the legitimate goreleaser tool name goreleaser-run, homepage spoofed to https://goreleaser.org; goreleaser is not officially published on npm. On every CLI invocation, bin/goreleaser.js...
Malicious code in mcp-server-github (npm)
Source: amazon-inspector 156761c4bd0e22759f082d7c030c241be12301dced1e58943c17aaacf9fe0958 Package squats the unscoped name mcp-server-github to intercept installs intended for the official @modelcontextprotocol/server-github. package.json declares "postinstall": "node index.js", so on every npm...
Malicious code in phantomx-tool-client (npm)
Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers handlers that hand off remote-supplied payloads to...
cicd-sensor rules/v20260722-001
🚧 Pre-release: Active development. cicd-sensor is currently in pre-release and under active development. Feedback is very welcome. cicd-sensor Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD. → Full documentation Demo ---...
CVE-2026-9830
creationtimestamp| type| source ---|---|--- 2026-07-27 21:00:03+00:00| seen| Telegram/jZonNK9LGMSvoC2Djs86LRDYxmpyv3NgFItsHIOxESbAXI 2026-07-27 21:00:03+00:00| seen| Telegram/MNUQPIGpAGeGg3WQfZgMMHal6jpwzokF-mfI2PhU7te8xo 2026-07-27 21:00:03+00:00| seen| https://t.me/GithubRedTeam/95407 2026-07-2...
GHSA-MFG7-5GFP-C4W3 vulnerabilities
Vulnerabilities for packages: knative-kafka-broker-fips, apache-pulsar, apache-nifi, conductor-fips, druid, floci, conductor, metabase, airbyte-server, apicurio-registry, celeborn, keycloak, kayenta-fips, infinispan, opensearch, management-api-for-apache-cassandra-5.0, apicurio-registry-fips,...
GHSA-XCPC-8H2W-3J85 vulnerabilities
Vulnerabilities for packages: saf, sqlpad...
GHSA-MH99-V99M-4GVG vulnerabilities
Vulnerabilities for packages: rancher-api-ui, ts-patch, jupyter-base-notebook, langfuse, nextcloud-server, saf, serve, opensearch-dashboards, renovate, thingsboard, lerna, prism, kubeflow-katib, sqlpad, argo-workflows, pulumi, npm...
