Malicious code in internallib_v923 (npm)

Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse shell to the hardcoded callback host 10.0.72.151:443. Any...

Malicious code in @anngular/core (npm)

Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'. package.json declares a postinstall lifecycle script: curl -L...

Malicious code in @angjlar/core (npm)

Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', author 'angular', and repository URL...

MAL-2026-17534 Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

MAL-2026-17540 Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

MAL-2026-17562 Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

Malicious code in oleh-modal (npm)

Source: amazon-inspector cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545 Package [email protected] is a credential-harvesting phishing kit disguised as a wallet-connect modal component. It renders fake MetaMask/Phantom/Rabby/OKX 'restore vault' modals that link to the legitimate...

Malicious code in @kibt/www-nuxt-i18n (npm)

Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of the expected real package to succeed. The package.json...

Malicious code in @angulra/cli (npm)

Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage, keywords, dependencies. Its package.json defines a...

RHEL 10 : libvirt (RHSA-2026:75583)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75583 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating system...

RHEL 8 : pki-core:10.6 (RHSA-2026:75573)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:75573 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: Dogtag/PKI:...

RHEL 10 : freerdp (RHSA-2026:75570)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75570 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

PT-2026-106050

Name of the Vulnerable Software and Affected Versions HyperShift operator affected versions not specified Description A flaw in the HyperShift operator allows a tenant isolation bypass. The operator copies user-provided Kubernetes configuration kubeconfig secrets into the privileged control plane...

CVE-2026-101919: Improper Input Validation

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

RHEL 9 : mariadb-connector-c (RHSA-2026:75673)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:75673 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

RHEL 9 : gimp (RHSA-2026:75575)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75575 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

RHEL 8 : kernel-rt (RHSA-2026:75746)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75746 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...