Malicious code in bs58-86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057e2e470e0bc9dbfd2ff37955c0c7d051cca944025b9d62c882ffc98c4434e5 Package [email protected] reproduces the name, README, repository URL cryptocoinjs/bs58, and exported API of the widely-used bs58 base58 encoding library...

Malicious code in easy-time-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b7b165f80957e2b2c8484fe6a51c4c4354727dadd36a51c39265f58e916935 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tokenization-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f8a194aa79844110dede95f5f8c798d05c04c08f1a4f5d8822124b17c65fa6 The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the calculateTokenPrice...

MAL-2026-6440 Malicious code in tokenization-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f8a194aa79844110dede95f5f8c798d05c04c08f1a4f5d8822124b17c65fa6 The package advertises plain math/formatter helpers but index.js contains a heavily obfuscated payload concealed inside the calculateTokenPrice...

CVE-2026-13311

shell-quote prior to 1.8.5 finalizes parsed tokens in parse using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse runs in On^2 time relative to the number of input tokens. An attacker who can supply an...

CVE-2026-13311

shell-quote prior to 1.8.5 finalizes parsed tokens in parse using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse runs in On^2 time relative to the number of input tokens. An attacker who can supply an...

MAL-2026-6441 Malicious code in unifydata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c62d93328810f03f3aac73777f406eee1b3413e1c3320eb87f3445754dba9d3 On require'unifydata', index.js calls initPlugin at module top level, performs an HTTPS GET to https://jsonkeeper.com/b/B40HL, JSON-parses the...

MAL-2026-6415 Malicious code in anthropic-claude-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39eab369e2498da827d3bbd331effdf24b99ab28961e62da7328e4476e328876 Package anthropic-claude-latest claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code; the README is for an unrelat...

Malicious code in block-slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9443517fbcf695478ab489e9a375823ed1a0030cf6a3a4f6262effca4c5406b Pattern matches fired on index.js for the co-occurrence of childprocess require, HTTP GET calls, and env-related keywords within a single file. No...

MAL-2026-6408 Malicious code in @su-doughnym/loginui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5768349705baa7b448fddb22d17412ce7befdaedd68b2e91a452eb6521e0bc66 Package self-identifies as a HubSpot dependency-confusion proof-of-concept and is published at version 99.99.99 — a typical high-version-pin used to...

Malicious code in @su-doughnym/metrics-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1b02acc9d8d069bfdf5db415cb18c33e05ffdcd577532cfc3dbd112e4d9a6f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6410 Malicious code in @su-doughnym/react-dlb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2269beae8c30caccda966ca3aba35c3eddb4795fba0161045f14758ff150f58b Package self-identifies as a dependency-confusion bug-bounty proof-of-concept and is published at version 99.99.99 to win resolution priority over an...

MAL-2026-6411 Malicious code in data-fetching-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913d882d66d587abb1d6fe92b8b6d7353c1b4ae79fb175cc3f10b606dd5f8457 Package self-identifies in its package.json description as a bug-bounty dependency-confusion proof-of-concept against an internal package name of the...

CVE-2026-44168

A flaw was found in MariaDB. During a State Snapshot Transfer SST, the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a...

PT-2026-52447

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4 Description Nokogiri is an open source XML and HTML library for the Ruby programming language. The Nokogiri::XML::NodeSet function and its alias slice performs a bounds check on the requested index using a...

PT-2026-52249

In the Linux kernel, the following vulnerability has been resolved: mm/list lru: drain before clearing xarray entry on reparent memcg reparent list lrus clears the dying memcg's xarray entry with xas store&xas, NULL before reparenting its per-node lists into the parent. This opens a window where ...

PT-2026-52450

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4 Description The CRuby native extension of this XML and HTML library can leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code has already accessed an attribut...

PT-2026-52338

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where an uninitialized stack variable is used within the rseq exit user update function. This occurs because the evaluation order of expressions in an initializer list is...

Malicious code in leo-config (npm)

The leo-config npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

Malicious code in leo-auth (npm)

The leo-auth npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...