Malicious code in @onum-releases/api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07908d7f0abe458955357ed6814b46c090c70e1b3d34be4dd1a5c02d2507127d On require, index.js reads os.hostname, embeds it as a subdomain label under a Burp Collaborator oastify.com host, and issues an https.get to that ho...

MAL-2026-6122 Malicious code in @onum-releases/api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07908d7f0abe458955357ed6814b46c090c70e1b3d34be4dd1a5c02d2507127d On require, index.js reads os.hostname, embeds it as a subdomain label under a Burp Collaborator oastify.com host, and issues an https.get to that ho...

CVE-2026-55414

creationtimestamp| type| source ---|---|--- 2026-06-18 14:25:37+00:00| published-proof-of-concept| https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4 2026-10-15 17:47:10+00:00| seen| https://infosec.exchange/users/cve/statuses/117446176263991457...

CVE-2026-54297

creationtimestamp| type| source ---|---|--- 2026-06-18 13:20:52+00:00| published-proof-of-concept| https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r 2026-06-23 13:41:44+00:00| seen| https://gist.github.com/muhamedfazalps/a3449070789a6a2c13d4d4e844af803b...

CVE-2026-55229

creationtimestamp| type| source ---|---|--- 2026-06-18 13:04:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2mrg-35hw-x3x9 2026-07-11 13:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqeptauyzd2r 2026-07-13 23:37:05+00:00| seen|...

CVE-2026-54317

creationtimestamp| type| source ---|---|--- 2026-06-18 09:17:38+00:00| published-proof-of-concept| https://github.com/home-assistant/core/security/advisories/GHSA-x84v-g949-293w 2026-06-24 12:13:59+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mozvbqteme22...

CVE-2026-55832

creationtimestamp| type| source ---|---|--- 2026-06-18 07:13:10+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5...

CVE-2026-54527

creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:58+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 2026-07-08 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64oaqtfb24 2026-07-09...

CVE-2026-54528

creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:50+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-rm2h 2026-08-01 18:19:51+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms23gwvzea2r...

CVE-2026-55185

creationtimestamp| type| source ---|---|--- 2026-06-18 03:23:33+00:00| published-proof-of-concept| https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r...

PT-2026-53139

Summary The published npm package praisonai exports createAgentLoop, whose onToolCall callback is documented and exampled as an approval hook. The implementation calls PraisonAI's generateText wrapper with the caller's executable tools first, receives toolResults, and only then calls onToolCall...

CVE-2026-55890

creationtimestamp| type| source ---|---|--- 2026-06-17 19:16:51+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54 2026-07-10 18:19:27+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqcr5yvo6n2j 2026-07-10...

CVE-2026-55885

creationtimestamp| type| source ---|---|--- 2026-06-17 19:15:53+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf 2026-07-10 22:57:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdapxlil62s 2026-07-10 23:41:55+00:00|...

MAL-2026-6075 Malicious code in opt-archetype-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6497b3f44c017bc9ba783cd75e17d4992f79542d8819558da92e152ee4d4471e On npm install, the package's postinstall hook executes node index.js, which collects the installer's public IP via api.ipify.org, hostname, username...

CVE-2026-55603

creationtimestamp| type| source ---|---|--- 2026-06-17 17:17:39+00:00| published-proof-of-concept| https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm 2026-06-23 09:03:07+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mox25jonrk2t...

CVE-2026-55602

creationtimestamp| type| source ---|---|--- 2026-06-17 17:17:28+00:00| published-proof-of-concept| https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj...

CVE-2026-55686

creationtimestamp| type| source ---|---|--- 2026-06-17 16:22:45+00:00| published-proof-of-concept| https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq 2026-06-26 18:39:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7lqvuf5f26...

CVE-2026-55093

creationtimestamp| type| source ---|---|--- 2026-06-17 15:29:25+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg...

CVE-2026-54695

creationtimestamp| type| source ---|---|--- 2026-06-17 14:39:37+00:00| published-proof-of-concept| https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85 2026-07-09 20:26:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqahs45ntd2x...

CVE-2026-55471

creationtimestamp| type| source ---|---|--- 2026-06-17 13:06:00+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf 2026-07-08 22:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64rso5sc2z...