PYSEC-2026-3763

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886 openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886: Incomplete List of Disallowed Inputs

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

PT-2026-76622

openssl encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

MAL-2026-14047 Malicious code in @guangnao/agent-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Malicious code in @ethers-js/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68 Package impersonates the ethers project real releases publish under ethers and @ethersproject/, not @ethers-js. The postinstall lifecycle script in...

Malicious code in js-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe The npm package js-assert-plus masquerades as an assertion library homepage http://js-assert-plus.com and bundles the real chai source so consumers g...

Malicious code in minimalistic-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75 The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require'minimalistic-assert-plus',...

MAL-2026-13696 Malicious code in postcss-initial-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...

Malicious code in dolyame-ui-inputrange (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g...

MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

CVE-2026-54218

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

MAL-2026-13490 Malicious code in fast-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503b750458783954b66f8dea6ee8b0300fd7db5b225280f1af432cf78c1faf6d setup.py defines a custom install command NativeInstall.run that decodes a base64 blob and passes it to execcompile... at install time. The decoded...

Malicious code in idnna (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f2ec3b09fbcf061a9f4ffefe1c179983ad8cdc0af705f2218280ade3c1da3 The package publishes under a name that closely resembles the widely-used idna package and advertises itself as 'HTTP client utilities', but the only...

Malicious code in pydanticc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc3a091548db52bab3bf8556e95780b3041aa971b6353d7f31bdb71128915a1 pydanticc is a typosquat of the popular 'pydantic' package. Its setup.py defines a custom setuptools install command whose body is stored as a base64...

MAL-2026-13486 Malicious code in fastapii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf67e733322de0ce3d08269697e6ccd9460233319cadd5f97f05c8d1e855665a fastapii 0.1.2 is a single-character typosquat of the popular fastapi package. Its setup.py registers a custom setuptools install cmdclass LinuxInsta...

MAL-2026-13487 Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

MAL-2026-13450 Malicious code in move-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00077e83bd841dae96e61d432da796cf21839a32e5caf03e7256b2573225335 [email protected] declares a postinstall hook package.json line 7: "postinstall": "node install.js" that runs install.js on npm install. install.j...