612409 matches found
MAL-2026-11131 Malicious code in basic-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...
MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...
MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...
Malicious code in @yancyyu/agentcli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...
MAL-2026-11141 Malicious code in lib-streak-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...
Malicious code in @ai_/autoprefixers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...
MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...
MAL-2026-11129 Malicious code in app-svm-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...
Malicious code in chain-analyze (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...
MAL-2026-11133 Malicious code in chain-analyze (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...
MAL-2026-11159 Malicious code in toll_free (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517b4b730525b8edcc11052acd0ad205b63c60f9009f97531df84eea39eaca97 package.json declares both preinstall and postinstall lifecycle hooks that run curl against a hardcoded webhook.site endpoint, sending the installer'...
Malicious code in toll_free (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517b4b730525b8edcc11052acd0ad205b63c60f9009f97531df84eea39eaca97 package.json declares both preinstall and postinstall lifecycle hooks that run curl against a hardcoded webhook.site endpoint, sending the installer'...
ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18209 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)
org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18209 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751613...
ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18214 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)
org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18214 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752077...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.31 bug fix and security update
Red Hat OpenShift Container Platform release 4.20.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.7 bug fix and security update
Red Hat OpenShift Container Platform release 4.22.7 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...
MAL-2026-11128 Malicious code in app-soda-layer (npm)
app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...
Malicious code in app-soda-layer (npm)
app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...
