MAL-2026-15911 Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...

Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...

MAL-2026-15896 Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

VulnCheck KEV: CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2026-71216: Cleartext Transmission of Sensitive Information

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

MAL-2026-15865 Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

Malicious code in 0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78 The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerate...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

zafrida-ui v0.3.7

中文 | English ZAFrida UI - PyCharm Frida Plugin Current Version: 0.3.6 Project Introduction Frida GUI Tool for PyCharm/IntelliJ ZAFrida UI is a Frida graphical interface plugin integrated into PyCharm and JetBrains IDEs. It aims to solve the complexity of Frida command-line operations and script...

A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses Towards Malicious Behaviors

Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the...

Fedora 45 : dracut (2026-5bf73fe397)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bf73fe397 advisory. - fixdevicetree-firmware: include soc specific firmwares in installgeneric - fixdevicetree-firmware: include Qualcomm X2 laptop model specific firmwares -...

Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...