MAL-2026-10983 Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...

Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f787426dd4d04d5cd527bdb19d309c64de82e252af4af0714dc33b07a26b73b0 [email protected] ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODEENV is not 'production', the code...

Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

MAL-2026-10982 Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f787426dd4d04d5cd527bdb19d309c64de82e252af4af0714dc33b07a26b73b0 [email protected] ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODEENV is not 'production', the code...

MAL-2026-10981 Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

DEBIAN-CVE-2026-16416

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

DEBIAN-CVE-2026-16422

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. Chromium security severity: High...

CVE-2026-16414

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

CVE-2026-63961

A flaw was found in the Linux kernel's USB Type-C DisplayPort DP alternate mode. A malicious or improperly configured USB-C device can send a malformed status update Vendor Defined Object VDO, which is a data structure used for communication. This can cause the kernel to read uninitialized memory...

CVE-2026-16422

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. Chromium security severity: High...

CVE-2026-16416

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

CVE-2026-16416

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

CVE-2026-16416

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

CVE-2026-16414

CVE-2026-16414 affects Chromium-based Chrome/Chromium with insufficient validation of untrusted input in Chromecast, enabling potential sandbox escapes via crafted network traffic. Affected versions are prior to 150.0.7871.182 (Chromium security note: High). Public advisories and distro trackers ...

CVE-2026-16414

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

CVE-2026-8986 Command Injection via Malicious OCPP Server

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-63898

A flaw was found in the Linux kernel's mctu232 USB serial driver. A malicious USB device could exploit this vulnerability by reporting a smaller endpoint maximum packet size than the driver expects. This incorrect handling of transfer sizes can lead to memory corruption, potentially allowing an...

MAL-2026-10979 Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...

Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...

Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac2a6fc7368c6b3ed1bfac9a3a9ea25e9a54ba5d980a48767c811e03fc72566 The package presents itself as a local color-palette toolkit but exports a public colors function in remote.py that POSTs to the hardcoded endpoint...