4875 matches found
CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...
MAL-2026-11506 Malicious code in beaver-ui-date-range-picker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744905f86e776fde6075a23e40274b0d4798bbb835114506926e0799430c24ba [email protected] declares a postinstall hook node setup.js and additionally triggers the same script from index.js via try...
Malicious code in simple-date-formatter-util-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...
Malicious code in simple-date-formatter-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e828348e997bf53071c8bc1d24adc305be689a64a56f2ababda6ef9370948d3 The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network activity, no lifecycle script...
Malicious code in test-dev-sync (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b79a278016b87011ec1e810ce455d87ab6346a1045cc007e0155b204c8cc2532 test-dev-sync is a browser data stealer coupled to a remote-command backdoor. grabberuser.js enumerates Chrome/Chromium/Opera/Vivaldi profiles under...
MAL-2026-11475 Malicious code in pm-claude-skills-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce00c3df3f5fdc8df05a880bb2abd711a8e1d7352b8067ef88d70d353e825e3c lib/report.js imports childprocess, fs, os, and https, then collects host and user identity data via os.hostname and os.userInfo, reads local files v...
Malicious code in rollup-plugin-polyfill-hold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...
Malicious code in @0xlr/test-callback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...
MAL-2026-11345 Malicious code in passtpor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e427a84573f9d6512d302e4f8ffc7c1011e5b9d337f4b084da29c797ce25b9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11299 Malicious code in ethers.jsonn (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acfd52ff30b26f15be66cbf87a098dde096288d776d0be4ecd555ac81e229f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11384 Malicious code in spectral-corsair (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c77441a8038182fe252b5782f82b900831bb6e4b598944ed0edfb4093e5fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11213 Malicious code in @grua/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b0588f2a4e3843bee403528cb8502b7c4207d2ce3179e51649b3951f8a8d2b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in switchpaymentsapiserv-paypal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdf45ca375c6a15e134abf2ab456c8cbd75e514d934e2c16b1d2b23e9677186a The package's preinstall lifecycle script runs automatically on npm install and exfiltrates installer identity data via DNS. It collects...
CVE-2026-64375
A flaw was found in the Linux kernel's proc filesystem. A local attacker with low privileges could exploit a race condition within the ptracemayaccess function when handling file descriptor links. This vulnerability arises because the system performs multiple task lookups without proper...
Malicious code in @bowozzz/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...
MAL-2026-11168 Malicious code in postcss-motion-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...
CVE-2026-42493
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...
Malicious code in stargateproxyserv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...
Malicious code in txs-random-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9f40781ae94116a5e9e1fb190897b78899c9e66abd10f1eb63216b78e986953 Package [email protected] was inspected but no concrete a static rule matches or traced-code findings are available for this verdict. The behavior...
