MAL-2026-12031 Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

SUSE CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

Malicious code in streak-metricazbd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF dist/math-core.bin to /tmp/sm-engine-runtime/math-core.bi...

Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

Checked-In Secret Detection: Strings Are All You Need

Hardcoded secrets in source code pose critical security vulnerabilities which can be easily exploited by malicious adversaries. Existing regex-based detection approaches suffer from fundamental limitations, as secrets often lack identifiable patterns, resulting in poor precision and recall. Recen...

Web Cache Overflow: Exploiting Imprecise Keys for Cache Degradation and Beyond

Web caches support the scalability needs of contemporary web applications by storing frequently accessed objects closer to clients. Web caches are conceptually associative arrays, tracking stored objects using cache keys consisting of HTTP request fields. However, these cache keys are often...

PT-2026-68335

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.21.7 through 3.21.9 Nuxt versions 4.5.0 and earlier Description When router.options.sensitive is set to false, mixed-case routeRules keys may fail to match case-folded lookups. This occurs because the lookup path is converted t...

PT-2026-68020

Name of the Vulnerable Software and Affected Versions Contact Form 7 – Dynamic Text Extension versions prior to 5.0.6 Description Stored Cross-Site Scripting occurs due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

PT-2026-68310

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description Authenticated low-privileged users with tunnel-creation permissions can perform a newline injection. By providing a percent-encoded newline character in the domain parameter of the tunnel creati...

PT-2026-68193

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2 Description Insufficient Session Expiration allows administrative API keys to remain active even after the associated administrator account is demoted, marked as inactive, suspended, or deleted. This resul...

PT-2026-67964

Name of the Vulnerable Software and Affected Versions Cost Calculator Builder versions prior to 3.6.18 Description An issue allows authenticated users with Subscriber-level access and above to gain unauthorized access to sensitive data. The cost-calculator-custom-export-run AJAX action, handled b...

PT-2026-81369

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description The software fails to sanitize IBM IAM bearer tokens and SSE-C Server-Side Encryption with Customer-Provided Keys encryption keys during S3 redirect callbacks. This allows credentials to be preserved...

CVE-2026-60053: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

MAL-2026-11994 Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

Malicious code in @zzzgenesis00/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig,...

MAL-2026-11529 Malicious code in @zzzgenesis00/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig,...

Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46 The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates...

Malicious code in simple-date-formatter-util-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f79e44f447b3ebd6b246845f4c31bff0a0fe2e3bc45b220e1a952bf1ddc66bb package.json declares a postinstall shell pipeline that attempts to mknod and mount the host block device at /tmp/hostroot, enumerates /etc/kubernete...