Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

MAL-2026-11129 Malicious code in app-svm-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

MAL-2026-11133 Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

MAL-2026-11159 Malicious code in toll_free (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517b4b730525b8edcc11052acd0ad205b63c60f9009f97531df84eea39eaca97 package.json declares both preinstall and postinstall lifecycle hooks that run curl against a hardcoded webhook.site endpoint, sending the installer'...

Malicious code in toll_free (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517b4b730525b8edcc11052acd0ad205b63c60f9009f97531df84eea39eaca97 package.json declares both preinstall and postinstall lifecycle hooks that run curl against a hardcoded webhook.site endpoint, sending the installer'...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18209 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18209 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751613...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18214 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18214 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752077...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.31 bug fix and security update

Red Hat OpenShift Container Platform release 4.20.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.7 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.7 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

MAL-2026-11128 Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...

Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...

ROOT-APP-NPM-CVE-2026-65900 CVE-2026-65900 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-65900 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

GHSA-3FXJ-6JH8-HVHX vulnerabilities

Vulnerabilities for packages: karma, fluxcd-kustomize-mutating-webhook-fips, fluxcd-kustomize-mutating-webhook, telegraf, karma-fips, zitadel, cosmo-router, cosmo-router-fips...

GHSA-C2RV-HWQM-WJPG vulnerabilities

Vulnerabilities for packages: opensearch...

Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

MAL-2026-11118 Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...