MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

MAL-2026-14067 Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

Malicious code in hunterone-build-probe-9210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e probe.js runs automatically via package.json preinstall and postinstall hooks "node probe.js || true". On execution it collects os.hostname,...

Malicious code in gunzip-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...

Malicious code in depcruise-fmt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...

Malicious code in depcruise-baseline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...

MAL-2026-14053 Malicious code in depcruise-baseline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...

MAL-2026-14054 Malicious code in depcruise-fmt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...

Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

MAL-2026-14052 Malicious code in require-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...

CVE-2026-72079

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

CVE-2026-72380 xen/pvcalls: bound backend response req_id before indexing rsp[]

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...

CVE-2026-72310 smb: client: fix overflow in passthrough ioctl bounds check

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

CVE-2026-72158

CVE-2026-72158 concerns the Linux kernel’s FPGA DFH handling in the dfl driver. The flaw: dfh_get_param_size() could report a parameter size larger than the feature region because the loop bounds check ran before incrementing size, and if EOP was set in the same iteration, an inflated size bypass...

EUVD-2026-58916

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

CVE-2026-72158 fpga: dfl: add bounds check in dfh_get_param_size()

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

CVE-2026-72079 Input: ims-pcu - fix use-after-free and double-free in disconnect

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

PT-2026-72568

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req id before indexing rsp pvcalls front event handler takes req id directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a stor...

MAL-2026-14071 Malicious code in @peptideventure/peptide-score-modifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9087a96f9eff6ac558764d4ba1ec4427d1d251447f891d1a62b58ee764d9ab1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...