Search results are sending people to fake Bitrefill checkouts

Bitrefill is a legitimate company that sells gift cards for popular stores like Amazon, Deliveroo, Apple, Nintendo, and thousands of others. They also sell eSIMs, and mobile top-ups. You can pay on their website for all of these with cryptocurrency. The scam is designed to catch people searching...

Fake popular sites offer a free app, instead take over PCs

A website built to look almost exactly like CNN’s homepage is telling visitors to download "the new CNN app." But it's not CNN’s app, and has nothing to do with the news company. The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing...

MAL-2026-13647 Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

MAL-2026-13622 Malicious code in @depup/astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c6330072ae71974da0dd2e0e72a33334a35b78ec5679536d95b9f205032225 This package is published under the @depup scope but sets author to 'withastro' and repository to github.com/withastro/astro, framing itself as a...

Malicious code in @depup/astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c6330072ae71974da0dd2e0e72a33334a35b78ec5679536d95b9f205032225 This package is published under the @depup scope but sets author to 'withastro' and repository to github.com/withastro/astro, framing itself as a...

Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

MAL-2026-13522 Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

Linux Distros Unpatched Vulnerability : CVE-2026-64655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the...

UBUNTU-CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

EUVD-2026-54222

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-64655

GitHub CLI (gh) prior to v2.97.0 builds the certificate Subject Alternative Name matcher from --signer-repo and --signer-workflow values without escaping regex metacharacters, causing user-supplied names to be treated as regular expressions. Because characters like '.' can appear in repository/wo...

CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

MAL-2026-13342 Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

MAL-2026-13288 Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

MAL-2026-13038 Malicious code in boxy-deps-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970 setup.js runs at install time: it performs an HTTPS reconnaissance request https.get to a remote host with an identifier payload and then spawns a...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...