MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af0c0528114fb5ac6296c3390b435a78ce9dc9f0d90fc606a6cf5d05b3472f0 No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltration, install-time remote cod...

MAL-2026-11025 Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af0c0528114fb5ac6296c3390b435a78ce9dc9f0d90fc606a6cf5d05b3472f0 No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltration, install-time remote cod...

MAL-2026-11022 Malicious code in aio-commerce-lib-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9479591a21dd21e28dbd04aaf239e1da57eae40a248247d8e270d8e6f1278fdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

MAL-2026-11028 Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11023 Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-16631

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

Fedora 44 : libssh (2026-0e46c91ccf)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0e46c91ccf advisory. New upstream security release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 43 : fractal (2026-9630be304f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9630be304f advisory. 14.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

OPENSUSE-SU-2026:11348-1 google-guest-agent-20260529.00-4.1 on GA media

These are all security issues fixed in the google-guest-agent-20260529.00-4.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-63959

Name of the Vulnerable Software and Affected Versions JetBrains WebStorm versions prior to 2026.2 Description Arbitrary code execution is possible through project-local package-manager tooling before the user grants trust to the project. Recommendations Update JetBrains WebStorm to version 2026.2...

Fedora 43 : libssh (2026-063caa9112)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-063caa9112 advisory. New upstream security release 2503148 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

SUSE SLES12 Security Update : joe (SUSE-SU-2026:3196-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3196-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Tenable has extracted t...

Fedora 43 : srt (2026-51628b98a8)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-51628b98a8 advisory. Update to 1.5.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...