CVE-2026-42089

CVE-2026-42089 أداة مساعدة لتثبيت الحزم المحلية وثقت كثيرًا في أسماء الحزم المقدمة من المتصل. في yeoman-environment، كان من الممكن تثبيت المولدات المفقودة دون تأكيد المستخدم، مما يحول بيانات المشروع الخاضعة لسيطرة المهاجم إلى مسار لتثبيت الحزم وتنفيذ الأكواد. مقدمة وجدت هذه المشكلة أثناء مراجعة...

CVE-2026-11417-AWS-CDK-RCE

Командная инъекция в цепочке поставок в AWS CDK NodejsFunction CVE-2026-11417 Автор: Hesham Ashraf @HeshamASH Дата: 10 июня 2026 Серьёзность: высокая CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Некорректная нейтрализация специальных элементов, используемых в OS-команде инъекция OS-команд Затронутый...

ReactNext2Shell

React-Next-Scanner ماسح ضوئي آمن لواجهة الأوامر لـ CVE-2025-55182 و CVE-2025-66478 توفر هذه الأداة ماسحًا خفيفًا للثغرات غير استغلالي يركز على مجموعات JavaScript الحديثة، وتحديدًا: خدمات API المتأثرة بـ CVE-2025-55182 تطبيقات Next.js المتأثرة بـ CVE-2025-66478 يعمل على: ✅ Windows ✅ Linux ✅ macOS ...

Malicious code in redis-cookie-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in eslint-prettier-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...

MAL-2026-15601 Malicious code in eslint-prettier-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...

Malicious code in fuels-forc (npm)

The package 'fuels-forc' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd bin/cli.js runs whoami and reads os.hostname / os.platform, then POS...

Malicious code in fuels-versions (npm)

The package 'fuels-versions' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d9f8a553c586813518fefc4735aa6ee3416720489a27c83b8eff10c1a6a755 bin/cli.js contains a hardcoded out-of-band callback URL at...

MAL-2026-15673 Malicious code in fuels-versions (npm)

The package 'fuels-versions' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d9f8a553c586813518fefc4735aa6ee3416720489a27c83b8eff10c1a6a755 bin/cli.js contains a hardcoded out-of-band callback URL at...

MAL-2026-15626 Malicious code in fuels-forc (npm)

The package 'fuels-forc' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd bin/cli.js runs whoami and reads os.hostname / os.platform, then POS...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper : injection de commande système via les options de l'outil ffmpeg runFFmpegCommand transmet une chaîne construite à partir des paramètres de l'outil MCP à spawn…, shell: true , si bien que les métacaractères shell présents dans options, format, codec,...

MAL-2026-15581 Malicious code in cloudfcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1caf6a2a9c9e406a086a5eef2c95f0248003441ebb663fb0fd215aefd9565198 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in cloudfcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1caf6a2a9c9e406a086a5eef2c95f0248003441ebb663fb0fd215aefd9565198 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in real-browser-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276e32a0246539a0495937fdf1967c9f2c778d4e902f14bc921148e4edbb0648 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in h2-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0176fe223a6df20d633d05a3e0ab21c2e87d0169342e820beadccc5817acc7bc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in h3-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6efe15c8b6a625f5ec662fc1d19f3191d0c9cd4a118565283dbe7ac9be1f54a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15585 Malicious code in h3client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46b4326d43002283dd4c729f099bd53573ca46f6c706492214d37df4bf6c51b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15584 Malicious code in h3-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6efe15c8b6a625f5ec662fc1d19f3191d0c9cd4a118565283dbe7ac9be1f54a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15583 Malicious code in h2-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0176fe223a6df20d633d05a3e0ab21c2e87d0169342e820beadccc5817acc7bc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in cloufcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb997ba2e8af58bd0d35d6e2cfb2264b4ae0132e071fc5b0e3e58f3326e37a9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...