MAL-2026-10093 Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

MAL-2026-10078 Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

ROOT-APP-NPM-CVE-2021-44906 CVE-2021-44906 in minimist - Patched by Root

Root has patched CVE-2021-44906 in the minimist package for Root:npm. Multiple fixed versions available...

Malicious code in @wagni_bot/ethereum-wallet (npm)

The npm package @wagnibot/ethereum-wallet is a supply-chain credential stealer disguised as a an Ethereum wallet library SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

ROS-20260709-73-0034

The vulnerability in python-pip relates to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Important: tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive...

Malicious code in @wagni_bot/pumpfun-sdk (npm)

The npm package @wagnibot/pumpfun-sdk is a supply-chain credential stealer disguised as a Pump.fun SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

CVE-2026-55849 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

MAL-2026-6991 Malicious code in airkey-mfa-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addd30fd6d90110d178ea017b2968c6014dab0e8304bdfeb55b13612a75f61da Package auto-executes a preinstall script node test.js on npm install that collects username, hostname, platform, Node version, and CI flag and POSTs...

MAL-2026-6987 Malicious code in @luminarycloudinternal/lcvis-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24 Package @luminarycloudinternal/[email protected] is published to the public npm registry under an internal-looking scope with an artificially high...

MAL-2026-6985 Malicious code in promo-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a88c879a569b51180b134bd442917610efba2cfc54aa980cb3ec3b4731e84c No concrete evidence of installer-side harm was identified for this package version. There are no indicators of credential theft, environment scrapin...

ROOT-APP-NPM-CVE-2026-30226 CVE-2026-30226 in @rootio/devalue - Patched by Root

Root has patched CVE-2026-30226 in the @rootio/devalue package for Root:npm. Multiple fixed versions available...

MAL-2026-10085 Malicious code in dependency_confusions (npm)

The npm package dependencyconfusions version 99.9.9 performs install-time host fingerprint and project path exfiltration. package.json sets index.js as the package main entrypoint and defines postinstall: node index.js. During npm install, index.js builds a JSON payload containing the local...

Malicious code in dependency_confusions (npm)

The npm package dependencyconfusions version 99.9.9 performs install-time host fingerprint and project path exfiltration. package.json sets index.js as the package main entrypoint and defines postinstall: node index.js. During npm install, index.js builds a JSON payload containing the local...

MAL-2026-6973 Malicious code in gitlens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c60743ac7b975c729e8ff8bd5310f71fce030efc3979f419f60e129921364ae7 package.json declares a preinstall lifecycle hook that runs curl https://bt8hbz0owdan31qvdap2u5b8izoqcg05.oastify.com on npm install. oastify.com is...

MAL-2026-6963 Malicious code in karem-dp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c16a2d6eecaab10a4c75e9b3b79f0c63c202b8acc31fd1d47a3651c7fa3cf10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6967 Malicious code in nam-os-a-man (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a483a2ae78f1f6f7d3d4da1ab74cc189f29564e002299f09c19e0d3eb41e40aa The package declares a postinstall hook that runs index.js on npm install. index.js collects the installer's OS username os.userInfo.username, hostna...

MAL-2026-6969 Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

[SECURITY] [DLA 4673-1] dpkg security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4673-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout July 08, 2026 https://wiki.debian.org/LTS -...

MAL-2026-6946 Malicious code in @whs4/whs4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c81447f382f370870e9dccf39168ae4d5b8105b5a94f04c7b541bbcc43598f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...