Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...

CVE-2026-17600

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

CVE-2026-56818

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...

MAL-2026-13668 Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

CVE-2026-17599

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

MAL-2026-13581 Malicious code in dolyame-ui-inputrange (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g...

MAL-2026-13519 Malicious code in streak-kit-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...

MAL-2026-13516 Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

Malicious code in gas-diff-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b On require, index.js runs an IIFE that persists an install timestamp and UUID under /.forge/gas-diff.json. After 72 hours have elapsed since first...

RLSA-2026:50979 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 Bug Fixes and Enhancements: Kernel...

kernel-rt security, bug fix, and enhancement update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

EUVD-2026-54279

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-17599: Unverified Password Change

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

Malicious code in opencode-optimised-toolings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...

Malicious code in gpt-terminal-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached...

MAL-2026-13447 Malicious code in gpt-terminal-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached...

Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...