MAL-2026-16246 Malicious code in kartyk-github-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf7fd25b60cd680892113ab7de697ebe897542c013c8c4a977bb4852a593619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5c66c5e78670d2099776492aa1a836a031eea3a9d43b2ffe5911a19b62c71d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16245 Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16247 Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5c66c5e78670d2099776492aa1a836a031eea3a9d43b2ffe5911a19b62c71d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16244 Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview pkg-rollback-dreed-viced-sonic-ponds is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview kartyk-github-token-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview kartyk-github-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview kartyk-github-single-ver-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-61709: Improper Preservation of Permissions

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound...

PT-2026-93730

Name of the Vulnerable Software and Affected Versions ag-ui-protocol ag-ui version 1.0 Description A remote attack targeting the SSE Client component in the file sdks/community/go/pkg/client/sse/client.go can lead to excessive resource consumption. SSE Server-Sent Events is a mechanism that allow...

CVE-2026-92361: Uncontrolled Resource Consumption

A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the component SSE Client. Such manipulation leads to resource consumption. The attack can be executed remotely. The pull request to fi...

PT-2026-93748

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.18.1 Description The ListUsers API could incorrectly return a user who should have been excluded. This occurs when an authorization relation uses an intersection containing a base but not excluded operand, the base ...

Malicious Package

Overview kartykp-prod-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16197 Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview kartykp-token-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...