Malicious code in xapi-lib (npm)

[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which i...

Malicious code in proxyrubika (PyPI)

Source: kam193 dd55df978007c1a7548ff7e6a548553cf89bd536afffbc8b0921eb3efe31a342 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons based on the campaign: -...

CVE-2026-39991

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...

CVE-2026-47790

A cross-site scripting XSS vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP...

EUVD-2026-101990

A cross-site scripting XSS vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP...

EUVD-2026-101986

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...

CVE-2026-39991 Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...

MAL-2026-17882 Malicious code in tailwindcss-uniform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f1697009648c97e7dd3a40ca390dc89a11bef7b8af037d249021e5a74a874a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-22896

A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual...

EUVD-2026-101872

A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual...

CVE-2026-39991: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...

CVE-2026-47790: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP...

Malicious code in saeka (PyPI)

When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete...

MAL-2026-17876 Malicious code in @xxxfnbs21/hello-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69ca1e29da88b95415d443f6911d2facdbabec1a0cd7b756594ffdf4336e1442 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17888 Malicious code in @flexmr/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52 @flexmr/[email protected] ships a one-line re-export stub whose package.json declares its sole dependency daemon-thread-lookup-buffer via a direct HTTPS U...

MAL-2026-17868 Malicious code in @kre64/hello-npm-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 654ab50c81e138ba0fcc4b3775bc84574656f528ae4de5770a6441e850fdf8c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17879 Malicious code in @flexmr/ui (npm)

@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...

MAL-2026-17859 Malicious code in opencode2-windows-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263b5345eacdaa0cb508c1d73db3da28902fd6e018ce8c01dc99ebc6babb9f97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17854 Malicious code in opencode2-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17857 Malicious code in opencode2-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf9deaf78da8cb6d551cd438b47ce0b248159ff7ee5768fd54427262a271be93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...