Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

Malicious code in api-rs-tuils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4 [email protected] runs a malicious postinstall hook node test.js that executes obfuscated code in index.js against the installer's machine. The code...

EUVD-2026-60577

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626

SpiderFoot fails to HTML-escape correlation titles built from external scan data (server banners, metadata), allowing stored XSS: attackers inject malicious HTML/event handlers that execute scripts in operators' browsers when the correlations view is opened, potentially stealing API keys. No patc...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

PT-2026-77166

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API...

MAL-2026-14017 Malicious code in bs58-33 (npm)

npm/bs58-33 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-33x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency declar...

MAL-2026-13838 Malicious code in unitel4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5370545a3cd79dd914fd2af5c469caf0f8942c74c14f760f34c3f6856e6648d Package contains only package.json and index.html, with main pointing at index.html. The HTML impersonates a Cloudflare 'Just a moment...'...

MAL-2026-13825 Malicious code in mnzjgxciwadk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb5ec6b21fbd7d0b720bf6dd7257a5b6e0e9428fe55d8197fccec53c79a662 The package contains a single file, index.html, which is also declared as the package main. The HTML presents a Cloudflare Turnstile-styled challenge...

Malicious code in bgncvhferucfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bf8639ccc5d2a70ae2e0ce754b76e1ca525699413f5d696289714005e86c57 The package's sole content is a single obfuscated HTML file declared as main. When loaded in a browser, the page renders a fake Cloudflare Turnstile...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

CVE-2026-48766 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

MAL-2026-13737 Malicious code in @openzeppelin-4/contracts (npm)

@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-13727 Malicious code in tailwind-elements-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f8605cff87e89b9f1a50c65fc27af278335cf414a8b4fb52ea4090e9fdd71b No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libraries, which can indicate...

MAL-2026-13721 Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks

Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it's thought that passkeys will replace passwords entirely. But what happens when malware steals the...

MAL-2026-11997 Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

CVE-2026-4648

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...

CVE-2026-4648

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...