RHSA-2026:37534 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:30169 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

Malicious code in fetchcraft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a40f1af8ba957a18b37ddba0dbe5634112f489841b22208eff421f9a09f786 package.json declares the runtime dependency node-runtime-utils as https://github.com/Hexa-devy/node-runtime-utils/archive/refs/heads/main.tar.gz — a...

MAL-2026-10438 Malicious code in netspeedutil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1 On install, setup.js walks up to the installer's project tree and scans image files for a 'STEG' marker. When found, it AES-256-CBC-decrypts an...

MAL-2026-10434 Malicious code in env-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9955128054ee66cd4675be3884e92f9e541ad7e9673496ece60e932c0b83ca5f [email protected] presents as a zero-dependency env loader but on require schedules a 72-hour-delayed activation that POSTs a host fingerprint hostname,...

MAL-2026-10431 Malicious code in @tailwind-ts/eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8feb6293e6f7cb00a6c6ab82e6d04f8eae29e846ae0abb8a1d65e2cdfbbc9c7 Package is published as an ESLint plugin for Tailwind CSS v4, but the shipped code implements unrelated Polymarket Kelly stake math and a postinstall...

MAL-2026-10440 Malicious code in type-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6706d0ad662da8d23eaf47c64780a777f3ec215d8864caf1e0962289463efb The package presents itself as a logger module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files...

Malicious code in react-hot-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051 index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any...

MAL-2026-10439 Malicious code in react-hot-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051 index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any...

Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...

MAL-2026-10432 Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...

MAL-2026-10437 Malicious code in jsonfb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fc07bf73ed684a1d555baa4dc6cadcd170bde4da4779ef62c0dd3f9cf02c99a Package [email protected] is presented as a JSON.parse bigint helper mimicking json-bigint, and re-using the real json-bigint maintainer's name in...

Malicious code in jsonfb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fc07bf73ed684a1d555baa4dc6cadcd170bde4da4779ef62c0dd3f9cf02c99a Package [email protected] is presented as a JSON.parse bigint helper mimicking json-bigint, and re-using the real json-bigint maintainer's name in...

Malicious code in turbocalcng (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f668de627f83b0348d681edd090804f202add609fdc9a3c671f987608fb448 turbocalcng/init.py imports arithmetic.py, which — beneath a facade of arithmetic helpers — contains an XOR-obfuscated in-memory native code executio...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Malicious code in @nsub/nitxe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16147b7ac55d6c4cc4e042be73e6d49fc7232e8a03f406fecd034cdd27bf0eb The package's declared npm postinstall script collects the installer's username os.userInfo.username, hostname os.hostname, platform, and the entire...

MAL-2026-10429 Malicious code in @nsub/nitxe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16147b7ac55d6c4cc4e042be73e6d49fc7232e8a03f406fecd034cdd27bf0eb The package's declared npm postinstall script collects the installer's username os.userInfo.username, hostname os.hostname, platform, and the entire...

MAL-2026-10430 Malicious code in prettier-plugin-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e4c522699877c1eca1bb9c838a443e3c4bfa21950cf5c5b1d23182ae91a534e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in prettier-plugin-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e4c522699877c1eca1bb9c838a443e3c4bfa21950cf5c5b1d23182ae91a534e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10428 Malicious code in sysb1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 530efe2fec0ffeabda93aa5e9718161f131bb28d35f28432d5d2c2da6e4763a4 The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. index.js declared as both mai...