MAL-2026-11019 Malicious code in veskr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...

MAL-2026-11009 Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

MAL-2026-11016 Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b247c0aaff056911572cd72fb377332194aa11aa4ada038039e3c35a6755e2a The package [email protected] 6 files exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fetching or executing remote...

MAL-2026-11008 Malicious code in caldryn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c9be7dd8b0d1fe026c48f500d432db06ebfb7bbb0721e3b1426cd29940fd1e No a static rule matches and no traced behavioral findings were produced for this package version. There is no observed evidence of install-time or...

Malicious code in veskr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...

MAL-2026-11017 Malicious code in vectormark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...

Malicious code in vectormark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...

Malicious code in react-tabulix-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 413e61124e5f46f550114ce54d841c1dc68b4dc3a9d0939c8f3c021a6c790a65 The package's package.json preinstall script runs dist/index.d.js, which base64-decodes an embedded payload and executes it. The decoded payload uses...

MAL-2026-11015 Malicious code in react-tabulix-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 413e61124e5f46f550114ce54d841c1dc68b4dc3a9d0939c8f3c021a6c790a65 The package's package.json preinstall script runs dist/index.d.js, which base64-decodes an embedded payload and executes it. The decoded payload uses...

Important: Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

Red Hat OpenShift Virtualization release v4.22 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

GHSA-JQQW-37X4-9RWJ vulnerabilities

Vulnerabilities for packages: gnutar...

MAL-2026-11040 Malicious code in react-tabulix-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...

Malicious code in react-tabulix-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...

ROOT-APP-GOBINARY-CVE-2026-39882 CVE-2026-39882 in rootio-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp - Patched by Root

Root has patched CVE-2026-39882 in the rootio-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp package for Root:Go. Multiple fixed versions available...

Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the...

GHSA-4V35-78JC-648R Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the...

CVE-2026-65590

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

CVE-2026-65590

Summary: CVE-2026-65590 affects n8n before 2.29.8 and 2.30.x before 2.30.1 due to missing shell sandbox enforcement in the @n8n/computer-use package on Linux/Windows (macOS sandbox exists). It allows shell commands to run with unrestricted filesystem and network access from the computer-use agent...

CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...