Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

Malicious code in css-flow-render-shim (npm)

[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...

MAL-2026-17655 Malicious code in css-flow-render-shim (npm)

[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...

MAL-2026-17639 Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

Malicious code in erc7730-hackathon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17628 Malicious code in erc7730-hackathon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17556 Malicious code in css-ogojwh-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff543635c832e0563229f42fcc7673c835f2ba5a9ae41d680aa572cfba49765 [email protected] presents itself as a CSS polyfill but ships thunderboltRegistry.js which, on require, runs an IIFE that executes shell...

MAL-2026-17486 Malicious code in css-scroll-state-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffa0affc34bac3fa24fcc7c67aae4d120066f4f856cb8b637bc04c6ca9d482c The package presents itself as a CSS polyfill but ships a payload file thunderboltRegistry.js that executes an IIFE at require time. The IIFE uses...

Malicious code in css-relative-color-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee0efef48c7d56201a037b237f11ec712853f86e74f6a00ef8011732b31363f1 The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses childprocess.execSync to execute whoami,...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

CVE-2026-105105

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker ait-server in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command a...

MAL-2026-17462 Malicious code in echogen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in echogen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

EUVD-2026-90814

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

PT-2026-103785

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

MAL-2026-17213 Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

SUSE CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...