MAL-2026-2611 Malicious code in upstart-lending-status (npm)

Package is malware. It steals credentials, collects system info, and exfiltrates data to a remote server via postinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 627a2802a53ad7eb751fcac4b0a43245c6b0bf9e667db77051758b24d8bc4d96 The package...

MAL-2026-2564 Malicious code in gp-auth-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a24cae80696867d7d7b835ee70e1ef1e85373092f31cd93e2a35508ae3d2afb3 The package gp-auth-lib was found to contain malicious code. Source: ghsa-malware 73c001ebe2675cd78ef852bc2e78ff6fb837fd64b9b490dbea61c4ff1ca6d146 An...

Malicious code in ts-schema-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35c0f1b632f24027499340dfbe35df1f1d57bed2a5ad8327d688a7b23507a3 The package ts-schema-helpers was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2876 Malicious code in unisys-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f0369680ea400c89b8ab01dfc75f7a7df45c8a26bfc5631a636770ccf32c9ed The package unisys-common was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2875 Malicious code in unisys-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89bc257f69dca8cec54b15b47533c97f9b6b47f16aae5f2dc868ff7faaf0c93b The package unisys-auth was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2869 Malicious code in arlo-meeting-assistant-rtms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5f17c482aef8ac270cf630fe452dacc79acbeb0b473ffd0ac640769e1a0fb6 The package arlo-meeting-assistant-rtms was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in arlo-meeting-assistant-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 842ae675e3d076ecc89e2697ee378f503945bae268487584277cd92a93ec44fe The package arlo-meeting-assistant-backend was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2872 Malicious code in ts-form-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f2ff1bf87164fdeb2ca9c37d578f7156164a344ffd11bcdb84ce34880358fea The package ts-form-helpers was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in paysafe-venmo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fce8d34aa19e18a627c71bd9fd4d16246319ca05abafd983708a534663a573f The package paysafe-venmo was found to contain malicious code. Source: ghsa-malware 678a8d684fa9e6f72f98c45d404c3e749491bd582d4b78ddc4bc3d020ae3c172...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: grafana-operator, kubewatch, external-secrets-operator, dbmate, polaris, clickhouse-operator, mariadb-operator, smokescreen, nodetaint, dkron, omnibump, actions-runner-controller, gh, pluto, local-path-provisioner, envoy-ratelimit, go, flux-helm-controller,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kafkaexporter, kubewatch, kyverno-notation-aws, rancher-machine, verticadb-operator, k8ssandra-client, opentelemetry-operator, terraform, terraform-provider-azapi, aws-s3-controller, spegel, kyverno-policy-reporter-kyverno-plugin, cert-exporter, vault-secrets-webhook...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kubernetes-csi-external-attacher, rancher-machine, sftpgo, verticadb-operator, vexctl, grafana, k8ssandra-client, knative-client, opentelemetry-operator, terraform, terraform-provider-azapi, gh, syft, spegel, kubernetes-event-exporter,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kubernetes-csi-external-attacher, rancher-machine, sftpgo, verticadb-operator, vexctl, grafana, k8ssandra-client, knative-client, opentelemetry-operator, terraform, terraform-provider-azapi, gh, syft, spegel, kubernetes-event-exporter,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kafkaexporter, kubewatch, kyverno-notation-aws, rancher-machine, verticadb-operator, k8ssandra-client, opentelemetry-operator, terraform, terraform-provider-azapi, aws-s3-controller, spegel, kyverno-policy-reporter-kyverno-plugin, cert-exporter, vault-secrets-webhook...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cognitoidentity, eks-node-monitoring-agent, knative-serving, kyverno-notation-aws, rabbitmq-messaging-topology-operator-fips, dex-fips, lazydocker, terraform-provider-kubernetes-fips, temporal, gomplate-fips, crossplane-aws-provider, omni-fips...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cognitoidentity, eks-node-monitoring-agent, spark-operator, knative-serving, kyverno-notation-aws, rabbitmq-messaging-topology-operator-fips, dex-fips, lazydocker, terraform-provider-kubernetes-fips, temporal, gomplate-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cognitoidentity, knative-serving, dex-fips, temporal, crossplane-provider-family-aws-fips, crossplane-provider-keycloak, cloud-provider-vsphere, sbom-scorecard, custom-pod-autoscaler-operator, gpu-operator-fips, mage, tetragon-fips, hugo,...

CVE-2026-39565

Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through = 2.1.7...

CVE-2026-39615

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through = 3.3.53...

CVE-2026-35641

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can...