MAL-2026-6170 Malicious code in onesignal-hooks (npm)

The npm package onesignal-hooks published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

Malicious Package

Overview native-component-list is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in native-component-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a5b5fc0df7145b301573dc029802ddf1c8f351945d0877d43e499a34192673f The package native-component-list was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-201471

Malicious code in native-component-list npm...

MAL-2025-192345 Malicious code in native-component-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a5b5fc0df7145b301573dc029802ddf1c8f351945d0877d43e499a34192673f The package native-component-list was found to contain malicious code. Source: ghsa-malware...