MAL-2026-4866 Malicious code in @car-loans/deal (npm)

Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...

Malicious code in @cloudplatform-single-spa/managed-identities (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

MAL-2026-4867 Malicious code in @car-loans/deal-aff (npm)

Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...

CVE-2026-45321

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself...

@agiflowai/aicode-toolkit (>=0.6.0, <=1.1.0), @agiflowai/one-mcp (0.4.0) +101 more potentially affected by CVE-2026-45617 via liquidjs (>=10.15.0, <=10.25.7)

liquidjs NPM version =10.15.0, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.20.0-rc1 and more Source cves: CVE-2026-45617 Source advisory: SNYK:JS-LIQUIDJS-16960001...

@agiflowai/aicode-toolkit (>=0.6.0, <=1.1.0), @agiflowai/one-mcp (0.4.0) +101 more potentially affected by CVE-2026-45357 via liquidjs (>=10.15.0, <=10.25.7)

liquidjs NPM version =10.15.0, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.20.0-rc1 and more Source cves: CVE-2026-45357 Source advisory: SNYK:JS-LIQUIDJS-16960002...

CVE-2026-44971 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

EUVD-2026-32534

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...

Malicious Package

Overview skills-detector is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure

CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control C2 channels associated with GlassWorm, a persistent software chain campaign targeting software developers through malicious packages and extensions. "Since...

GHSA-76P7-773F-R4Q5 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-44646 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-44646 Source advisory: SNYK:JS-LIQUIDJS-16887887...

Linux Distros Unpatched Vulnerability : CVE-2026-46091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: rc: igorplugusb: heed coherency rules In a control request, the USB request structure can be subject to DMA on some HCs. Hence it must obey the rules for...

Linux Distros Unpatched Vulnerability : CVE-2026-45997

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: sd: fix missing putdisk when deviceadd&diskdev fails If deviceadd&sdkp-diskdev fails, putdevice runs scsidiskrelease, which frees the scsidisk but leaves...

Linux Distros Unpatched Vulnerability : CVE-2026-46037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: icmp: validate reply type before using icmppointers Extended echo replies use ICMPEXTECHOREPLY as the outbound reply type. That value is outside the range...

Linux Distros Unpatched Vulnerability : CVE-2026-46095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: raise barrier before state machine transition Move the barrier raise operati...

AlmaLinux 8 : ruby:3.3 (ALSA-2026:20614)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:20614 advisory. erb: ERB: Arbitrary code execution via deserialization bypass CVE-2026-41316 Tenable has extracted the preceding description block directly from the AlmaLinux...

Linux Distros Unpatched Vulnerability : CVE-2026-45850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph-len...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1743)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1743 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. CVE-2026-33811 When processing HTTP/2 SETTINGS frames, transport...