MAL-2026-10696 Malicious code in loader1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e15a852d5059620c9ee20b20a227907363f1b83c05bf642f2f077d11b4d08f66 The npm package's only file of substance is index.html declared as main in package.json. When opened in a browser, the page first disables...

Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

Malicious code in loader1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e15a852d5059620c9ee20b20a227907363f1b83c05bf642f2f077d11b4d08f66 The npm package's only file of substance is index.html declared as main in package.json. When opened in a browser, the page first disables...

MAL-2026-10695 Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

MAL-2026-10698 Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

MAL-2026-10697 Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

MAL-2026-10694 Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

ROOT-OS-DEBIAN-12-CVE-2023-31484 CVE-2023-31484 in rootio-perl - Patched by Root

Root has patched CVE-2023-31484 in the rootio-perl package for Root:Debian:12. Multiple fixed versions available...

MAL-2026-10743 Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

ROOT-APP-NPM-CVE-2024-21507 CVE-2024-21507 in @rootio/mysql2 - Patched by Root

Root has patched CVE-2024-21507 in the @rootio/mysql2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-6485 CVE-2024-6485 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2024-6485 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2024-10105 AIKIDO-2024-10105 in @rootio/pug - Patched by Root

Root has patched AIKIDO-2024-10105 in the @rootio/pug package for Root:npm. Multiple fixed versions available...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: coreutils: coreutils-9.11-5.hum1 aarch64, x8664 coreutils-common-9.11-5.hum1 aarch64, x8664 coreutils-single-9.11-5.hum1 aarch64, x8664 coreutils-9.11-5.hum1.src src...

MAL-2026-10692 Malicious code in nyt-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bf0f1d5cc9a57edf1b570b517d09c6acf7c98223858d08a5f162c250f6965f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...