EUVD-2026-57747

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...

MAL-2026-10161 Malicious code in sidecar-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b48cc2cf1326bc68eda84d3c97733c367be4309d93c9671ad4d36f431bd0353 The package ships a single bin entry sidecar-mcp, advertised as a one-command setup for Sidecar MCP servers. When the user runs that command, the CLI...