CVE-2026-54174

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...

MAL-2026-13179 Malicious code in dolyame-ui-react-version-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ee4e207fd01bae956d7fe084377ecea438f81774ea01ca6b02a50c1962c6cca Package advertises itself as a React UI helper but its index.js unconditionally requires./vendor at load time. vendor.js selects a platform-specific...