CVE-2026-27565

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

CVE-2026-27565 Remote code execution via uploading a malicious IODD file

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

MAL-2026-11504 Malicious code in accounts-final-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e67b952090179c0e7ed57045bf117d0cc14ca7d832ddce2963c4f2049b66bb Requiring accounts-final-form auto-runs setup.js via process.nextTickbootstrap in index.js. setup.js selects a platform-specific asset path...

Malicious code in test-dev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4f4885b543da795140d0ac9c44423c6ecadf74c744c1f322f9d1a5263fe4f2 No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of install-time or import-time code...

MAL-2026-11442 Malicious code in @mp-op-ss-front-lib/tracks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d870b0214c38734a6a9b3073e958bb198a11243a3093110cc85be0b7ae9bdb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

MAL-2026-11471 Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6163cb4abd0ceee120100e4ce84e0e12bff00348ee3b55ad338d7d1d3adca47d lib/report.js gathers the developer's email queried via gh api user/emails, git config user.email, /.gitconfig, npm config, and environment variables...

MAL-2026-11340 Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11304 Malicious code in express-sequelize-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbaa45eca2fa129cc92d16cd7b391a5af5d33fd35dc07a142359357cbf9cb29c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in easyinstaller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c4ea36235cf092d70fea18574aa582526923d2c869fb9f3846aabb0b180c76a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 203ee4d21fc1df2921367505b508c20e236b7eff515ec18e76ba29d22db661bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11301 Malicious code in etwl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e526e1b1272a9b3c18948e466b5380d199c4a81ff4ecd198c2ec0dfa2d69bfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11230 Malicious code in @sourav_chanduka/core-no-ngrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cde51a882f2a66e53c2a19231a1963c78555a63a7e2ea9c8e23b378ec072bd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11338 Malicious code in ncc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47e6426d64d44f277630e33c26db683f2d8cc1c043374a88ed3a484c84f7a242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11215 Malicious code in @meteora-sdk/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ec2029608b062badb250d90fac8d9e8f1ee6b7fca98113fc02eb2468c11186a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11206 Malicious code in 1apijs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2700f92a449d39fb0881259de81734a6c2f7933dad7e567fd4284e58b6fe062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ttest333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b74ff57fa83801c9d727f00ead8619c39184c324bf8c82a1f34c7871154afe76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...