CVE-2026-34707

creationtimestamp| type| source ---|---|--- 2026-06-09 23:12:20+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnvd35nofr23...

CVE-2026-47955

creationtimestamp| type| source ---|---|--- 2026-06-09 23:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvchp5ryl2u...

CVE-2026-34711

creationtimestamp| type| source ---|---|--- 2026-06-09 23:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvcflawlb2n 2026-06-10 02:03:22+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnvmmyg4nr2a...

Malicious code in sb-original (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0e07a765f6ef2042da47b1c017ecc5f6f1f99167da76e04c4b2c4ea6ecfcb83 [email protected] is an unscoped package whose version is set to 9999.99.99 to win semver resolution against any internal package of the same...

CVE-2026-47928

creationtimestamp| type| source ---|---|--- 2026-06-09 22:32:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvatdnnrd2q 2026-06-10 08:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnwamaibk62s 2026-06-15 16:37:06+00:00| seen|...

CVE-2026-48292

creationtimestamp| type| source ---|---|--- 2026-06-09 22:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnv73jjyya27...

CVE-2026-48291

creationtimestamp| type| source ---|---|--- 2026-06-09 22:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnv73bc46r2y...

CVE-2026-32856

creationtimestamp| type| source ---|---|--- 2026-06-09 21:51:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv6l4h2yn2v...

CVE-2026-47907

creationtimestamp| type| source ---|---|--- 2026-06-09 21:41:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnv5z7dzfn2d 2026-06-12 03:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mo2r4tufxi2i...

CVE-2026-39170

SemCms 5.0 is vulnerable to Cross Site Request Forgery CSRF via crafted POST request to /admin/semcmsuser.php...

Malicious code in @nstrlabs/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d8d7c327560bb7a4c08d906db240a2dc146e20f828d9dfc5ab79497b155355 On npm install, the package's preinstall script node index.js || true executes automatically and collects host identifiers from the installer's machi...

MAL-2026-5423 Malicious code in @nstrlabs/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d8d7c327560bb7a4c08d906db240a2dc146e20f828d9dfc5ab79497b155355 On npm install, the package's preinstall script node index.js || true executes automatically and collects host identifiers from the installer's machi...

MAL-2026-5416 Malicious code in @klapp-otp/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9246974efd1a626094dd3f2027df2e8f1468ce45ebcba42e5207a06c5c9e16ee On npm install, this package auto-executes index.js via the preinstall lifecycle hook. The script collects os.hostname, os.userInfo, dirname,...

Malicious code in @klapp-otp/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9246974efd1a626094dd3f2027df2e8f1468ce45ebcba42e5207a06c5c9e16ee On npm install, this package auto-executes index.js via the preinstall lifecycle hook. The script collects os.hostname, os.userInfo, dirname,...

MAL-2026-5418 Malicious code in @nstrlabs/api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7b47a7f81209dbbaff286599b46f4f030ff992b6d0c25d947cc84739b838d9 @nstrlabs/[email protected] is a hollow package whose only behavior is an install-time exfiltration beacon. package.json declares "preinstall": "node...

MAL-2026-5420 Malicious code in @nstrlabs/ixel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b10f7a8ca25ac33a6d1e94038d1dbfd68d113d9ab7d7a428d97417b3409c7d On npm install, the package runs node index.js via a preinstall lifecycle hook declared as "preinstall": "node index.js || true" so failures are...

MAL-2026-5422 Malicious code in @nstrlabs/shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc72373a5a06d31becb2dd02ced949866c9da14ae6d0bfdb3b4f4c882e40445 On npm install, the package's preinstall script runs index.js, which collects host identifiers os.hostname, os.userInfo.username, dirname, process.cw...

MAL-2026-5419 Malicious code in @nstrlabs/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 608be3457e7c809e60c1b76b9406489652f0ef708bfb97db2b6e0bb92b6836c2 On npm install, the package's preinstall hook node index.js || true, declared in package.json automatically collects host identifiers — os.hostname,...

MAL-2026-5427 Malicious code in @payment-review/store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d624eaefbb0245bf0c9a7b598c461a3ba5ec48005cfec223898062741ef8c2e package.json declares preinstall: node index.js || true, so installing the package automatically runs index.js on npm install. The script collects ho...

MAL-2026-5417 Malicious code in @klapp-sca/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 495f510483f297a56d545e8555db20eb54569f904bfd71853e54a18d89812cb0 package.json declares "preinstall": "node index.js || true", so on every npm install the bundled index.js runs automatically and collects os.hostname...