MAL-2026-7027 Malicious code in @calm2026/imux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a755ff37a1fe6e18a3c050a0cf93bfadf80e790fd585c8e09a70179d07ec62f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb11.8: mariadb-11.8.8-3.hum1 aarch64, x8664 mariadb-backup-11.8.8-3.hum1 aarch64, x8664 mariadb-client-utils-11.8.8-3.hum1 noarch mariadb-common-11.8.8-3.hum1 noarch...

GHSA-36GR-GW56-G35V vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu, linux-azure, linux-vmware, linux-qemu-melange...

GHSA-RG3C-J3J2-X6PC vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu, linux-azure, linux-vmware, linux-qemu-melange...

GHSA-5RWX-CQG3-893X vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu, linux-azure, linux-vmware, linux-qemu-melange...

GHSA-J22C-2H2Q-55PV vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu, linux-azure, linux-vmware, linux-qemu-melange...

GHSA-RWQ9-95V8-58FQ vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu, linux-azure, linux-vmware, linux-qemu-melange...

CVE-2026-39822 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, redka, gatekeeper, caddy-fips, rke2-runtime-fips, apko, kubeflow-katib, azuredisk-csi-fips, timestamp-authority, docker-fips, kots, cloud-sql-proxy, prometheus-operator, kubernetes-csi-node-driver-registrar, atlantis-fips, cluster-autoscaler,...

CVE-2026-48504 vulnerabilities

Vulnerabilities for packages: parseable, mountpoint-s3, wasmcloud, deno, linkerd2-proxy...

GHSA-W9WP-H8WV-79JX vulnerabilities

Vulnerabilities for packages: parseable, mountpoint-s3, wasmcloud, deno, linkerd2-proxy...

CVE-2026-42505 vulnerabilities

Vulnerabilities for packages: chart-testing-fips, cluster-api-azure-controller-fips, skaffold, ytt-fips, multicluster-controlplane-fips, mlrun-log-collector, crossplane-provider-azure-netapp, docker-fips, crossplane-provider-family-aws, skopeo, kiali-fips, multus-cni-fips, conjur-cli,...

GHSA-79CF-XCQC-C78W vulnerabilities

Vulnerabilities for packages: argo-workflows, gitlab-rails-ce-fips, gitlab-rails-ce, kubeflow-katib, arangodb...

MAL-2026-7026 Malicious code in tailwind-core (npm)

The npm package tailwind-core versions 4.3.1 and 4.3.2 contain remote code execution payloads hidden in the exported Tailwind-style runtime. The package root export reaches code that fingerprints the host, communicates with attacker-controlled Google Apps Script/Drive or Sheets resources, decodes...

Malicious code in tailwind-core (npm)

The npm package tailwind-core versions 4.3.1 and 4.3.2 contain remote code execution payloads hidden in the exported Tailwind-style runtime. The package root export reaches code that fingerprints the host, communicates with attacker-controlled Google Apps Script/Drive or Sheets resources, decodes...

Malicious code in @wagni_bot/solana-sdk (npm)

The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/polygon-sdk (npm)

The npm package @wagnibot/polygon-sdk is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/eth-agent (npm)

The npm package @wagnibot/eth-agent is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/hyperliquid-sdk (npm)

The npm package @wagnibot/hyperliquid-sdk is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycl...

Malicious code in @wagni_bot/ethereum-wallet (npm)

The npm package @wagnibot/ethereum-wallet is a supply-chain credential stealer disguised as a an Ethereum wallet library SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/metemask-sdk (npm)

The npm package @wagnibot/metemask-sdk is a supply-chain credential stealer disguised as a MetaMask misspelled 'metemask' SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...