CLSA-2026-1792367406 TuxCare security update for @next/swc-linux-arm64-gnu (28 CVEs)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2...

CLSA-2026-1792367405 TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 15.1.2-tuxcare.1...

CLSA-2026-1792367395 TuxCare security update for @next/swc-linux-arm64-gnu (10 CVEs)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3...

CLSA-2026-1792367393 TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 16.0.6-tuxcare.4...

CLSA-2026-1792367391 TuxCare security update for @next/swc-linux-arm64-gnu (9 CVEs)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.7...

CLSA-2026-1792367381 TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 15.5.26-tuxcare.1...

CLSA-2026-1792367380 TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 15.5.24-tuxcare.1...

CLSA-2026-1792367379 TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 15.5.23-tuxcare.1...

CLSA-2026-1792367377 TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 15.5.25-tuxcare.1...

MAL-2026-17855 Malicious code in opencode2-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4a8829a49ed8b89e9b5b2e55e453eb1cec86c288c766ed209e907ee331a76f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17856 Malicious code in opencode2-linux-arm64-musl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29d77295b1fca10788c9203f4cddd81390c2257ed49c9f260838bf5c383bab8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

reasonix (>=1.1.0-rc.1, <=1.39.2) potentially affected by CVE-2026-102437 via @reasonix/cli-linux-arm64 (>=1.1.0-rc.1, <=1.39.2)

@reasonix/cli-linux-arm64 NPM version =1.1.0-rc.1, =1.1.0-rc.1, =1.39.2 Source cves: CVE-2026-102437 Source advisory: MEND:CVE-2026-102437...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-arm64-musl (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-arm64-musl NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-arm64 (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-arm64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

ARM virtualization subsystem Kernel Buffer Overflow DoS

The vulnerability of the vgicitsrestoredte function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM 64-bit kernel-based Linux operating system involves the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to access...

Malicious Package

Overview @postman-cse/okta-aio-linux-arm64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14357 Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

@ccfly/setup (0.1.0) potentially affected by unknown CVE via @ccfly/setup-linux-arm64 (0.1.0)

@ccfly/setup-linux-arm64 NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-arm64 and may be impacted: - @ccfly/setup 0.1.0 Source cves: unknown CVE Source advisory: GHSA-68FQ-2X3M-XH9H...

MAL-2026-13417 Malicious code in @ccfly/setup-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec The package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty PTY spawner and...