MAL-2026-13871 Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

Malicious code in n8n-nodes-http-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af index.js executes a top-level IIFE on module load that 1 spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacke...

PYSEC-2026-1144 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...

Malicious code in react-campaign-optimizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a040ca9a32fe68e08906bdc58b7ae907b8f8092acd9764266de15004b3922e9f On npm install, the package runs node postinstall.js declared in package.json scripts.postinstall which performs unauthenticated, unconsented...

GHSA-3M4Q-GGCJ-J6M4 Calico Inserts Sensitive Information into Log File

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig with bearer token,...

Calico Inserts Sensitive Information into Log File

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig with bearer token,...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

PT-2024-14253

Name of the Vulnerable Software and Affected Versions Airflow versions 5.2.0 through 6.x Airflow versions 2.3.0 through 2.6.0 Description The Airflow worker serializes a Kubernetes configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption wh...

PT-2020-12493 · Helm +1 · Helm +1

Name of the Vulnerable Software and Affected Versions: Helm versions 3.0.0 through 3.1.2 Description: There is an information disclosure issue in Helm. The lookup template function, introduced in Helm v3, can lookup resources in the cluster to check for the existence of specific resources and get...