Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

MAL-2026-10549 Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

Malicious code in temp-cloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec75c040be8d9901d8715cc65309341f95b497d35062ea6014b7e4a36b35ff89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10562 Malicious code in duration-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41e28074a6cb11bc84c0da4f15b1b2f5c8546f7955638eb34320bfbd62612908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @codex2005/logger-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f14223b7d9b3039682e27372df81a552cc1b451a99d60d5ec79e0d4696a7b800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vite-pro/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7 Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite,...

MAL-2026-10513 Malicious code in nodemon-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1d2f1b3c8848137e0ec6a9897d6f4056102623f1139549c9dd928fcb4482e69 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in claude-team-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e9f6179a67a2904c37bd9cff22174a8c57755972fc878047993c35c03f5544 On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached...

Malicious code in @dervix/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118dd8f5224b1dcccddf25d74c6c9fe3543b444173ea293dafa28154e82689d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6a306142d74b2781d66322adf2bc1b9898bfdb8e1814d2cb511c3e49b75c13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10477 Malicious code in @gleamkit/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6a306142d74b2781d66322adf2bc1b9898bfdb8e1814d2cb511c3e49b75c13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10470 Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

MAL-2026-10462 Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks

Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems. Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is implemented in...

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

Affects- Nova: =18.0.0 =32.0.0 =33.0.0 33.0.2 DescriptionErichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling...

PDM: Project-Local State and Config Writes Follow Symlinks

SummaryPDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets.This creates an arbitrary file clobber primitive relative to the privileges of the...

PYSEC-2026-2470 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summary fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the...

PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

SummaryPraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. DetailsThis issue affects...

PYSEC-2026-2897 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...