629293 matches found
MAL-2026-16113 Malicious code in etoro-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP...
MAL-2026-16119 Malicious code in etoro-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...
Malicious code in etoro-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...
MAL-2026-16120 Malicious code in etoro-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64a03f7bbaa2cb54ffea9a0c98d22bdc2fdb0d368846beefbd8d9c3b5ab3f644 The package's preinstall lifecycle script preinstall.js issues an HTTP GET to the hardcoded bare-IP endpoint...
MAL-2026-16118 Malicious code in etoro-charts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...
Malicious code in etoro-charts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...
Malicious code in etoro-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c The package's preinstall.js runs automatically on npm install and collects host identifiers os.hostname, os.userInfo.username, process.cwd,...
MAL-2026-16115 Malicious code in etoro-billing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c1ceae274b450706288722b9f6c049114593ef2671de93ac58c4fd4a7318c9a On npm install, the package's preinstall lifecycle hook executes preinstall.js, which reads os.hostname, os.userInfo.username, and process.cwd and...
Malicious code in etoro-billing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c1ceae274b450706288722b9f6c049114593ef2671de93ac58c4fd4a7318c9a On npm install, the package's preinstall lifecycle hook executes preinstall.js, which reads os.hostname, os.userInfo.username, and process.cwd and...
CVE-2026-62899 vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
CVE-2026-62901 vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
GHSA-M93F-WJ8C-RP8P vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
CLEANSTART-2026-VO98287 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Multiple security vulnerabilities affect the vault package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-QN07777 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Multiple security vulnerabilities affect the vault package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-TY53144 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Multiple security vulnerabilities affect the vault package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-GY20219 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the calico package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
CLEANSTART-2026-QV22657 Previously, resolving relative paths containing parent directory ('
Multiple security vulnerabilities affect the helm package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...
CLEANSTART-2026-BA26255 filippo
Multiple security vulnerabilities affect the dex package. filippo. See references for individual vulnerability details...
CLEANSTART-2026-HL20029 JLine is a Java library for handling console input
Multiple security vulnerabilities affect the kafka package. JLine is a Java library for handling console input. See references for individual vulnerability details...
Malicious Package
Overview discord-mfa-solver is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...