CLEANSTART-2026-JK20975 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CVE-2026-100570: Improper Neutralization of Argument Delimiters in a Command

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100579: Authorization Bypass Through User-Controlled Key

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100539: Incorrect Authorization

OpenClaw npm package 'openclaw' before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memorysearch and memoryget tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit...

CVE-2026-100547: Incorrect Behavior Order: Validate Before Canonicalize

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100554: Insufficient Session Expiration

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

Malicious Package

Overview tego-managed-agents-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview prosocks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview vercel-runtime-python is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sherpy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview wallet-connect-adapter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview epic-path-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-react-survey is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @alphaspace/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview n8n-nodes-moonlet-helpers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview n8n-nodes-moonlet-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview epic-react-search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview agency-testts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview agency-test-exercise is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview n8n-nodes-flowstats is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...