com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=15.8.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=15.4.1) +13 more potentially affected by CVE-2026-116803 via org.webjars.npm:dompurify (>=3.1.7, <=3.4.15)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.76.0, =3.37.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.57.0 Source cves: CVE-2026-116803 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-21755402...

com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=15.8.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=15.4.1) +13 more potentially affected by CVE-2026-116802 via org.webjars.npm:dompurify (>=3.1.7, <=3.4.15)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.76.0, =3.37.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.57.0 Source cves: CVE-2026-116802 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-21755404...

com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=15.8.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=15.4.1) +13 more potentially affected by unknown CVE via org.webjars.npm:dompurify (>=3.1.7, <=3.4.15)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.76.0, =3.37.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.57.0 Source cves: unknown CVE Source advisory: SNYK:JAVA-ORGWEBJARSNPM-21460658...

com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=15.8.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=15.4.1) +13 more potentially affected by unknown CVE via org.webjars.npm:dompurify (>=3.1.7, <=3.4.15)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.76.0, =3.37.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.57.0 Source cves: unknown CVE Source advisory: SNYK:JAVA-ORGWEBJARSNPM-21460656...

hades

Acerca de Hades es un loader de prueba de concepto que combina varias técnicas de evasión con el objetivo de eludir los mecanismos defensivos comúnmente utilizados por los AV/EDR modernos. Uso La forma más sencilla es probablemente construir el proyecto en Linux usando make. git clone...

com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=15.8.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=15.4.1) +13 more potentially affected by CVE-2026-109345 via org.webjars.npm:dompurify (>=3.1.7, <=3.4.15)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.76.0, =3.37.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.57.0 Source cves: CVE-2026-109345 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-20536985...

com.codbex.atlas:codbex-atlas-application (>=2.54.0, <=2.57.0), com.codbex.gaia:codbex-gaia-application (2.58.0) +8 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.24.1)

net.snowflake:snowflake-jdbc MAVEN version 3.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.54.0, =2.47.0, =2.47.0, =11.47.7, =11.47.7, =11.47.7,...

com.codbex.atlas:codbex-atlas-application (>=2.2.0, <=2.10.0), com.codbex.hades:codbex-hades-application (>=2.2.0, <=2.10.0) +15 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.23.0)

net.snowflake:snowflake-jdbc MAVEN version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =2.2.0, =11.6.1,...

com.codbex.atlas:codbex-atlas-application (>=1.4.0, <=2.1.0), com.codbex.hades:codbex-hades-application (>=1.6.0, <=2.1.0) +17 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.22.0)

net.snowflake:snowflake-jdbc MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =1.4.0, =1.6.0, =2.0.0, =1.6.0, =1.4.0, =1.3.0, =1.6.0, =470...

com.codbex.atlas:codbex-atlas-application (>=2.77.0, <=2.79.0), com.codbex.gaia:codbex-gaia-application (>=2.68.0, <=2.70.0) +19 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.26.1)

net.snowflake:snowflake-jdbc MAVEN version 3.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.77.0, =2.68.0, =2.60.0, =2.65.0, =2.59.0, =2.61.0, =3.21....

com.codbex.atlas:codbex-atlas-application (>=2.48.0, <=2.53.0), com.codbex.gaia:codbex-gaia-application (>=2.55.0, <=2.57.0) +17 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.24.0)

net.snowflake:snowflake-jdbc MAVEN version 3.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.48.0, =2.55.0, =2.42.0, =2.42.0, =2.42.0, =2.42.0, =2.42....

Malicious code in pyphetools (PyPI)

The package pyphetools version 0.9.120 contains a malicious .pth file pyphetools-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscate...

Malicious code in gpsea (PyPI)

The package gpsea version 0.9.14 contains a malicious .pth file gpsea-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscated JavaScrip...

Malicious code in embiggen (PyPI)

The package embiggen version 0.11.97 contains a malicious .pth file embiggen-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscated...

PYSEC-2026-1075 Malicious code in tiktoken-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of tiktoken-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials an...

Malicious code in tiktoken-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of tiktoken-mcp were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...

PYSEC-2026-1073 Malicious code in orchestr8-platform (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of orchestr8-platform were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...

Malicious code in openai-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of openai-mcp were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...

PYSEC-2026-1072 Malicious code in openai-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of openai-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

Malicious code in mem8 (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of mem8 were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...