Malicious code in bnpl-blocks-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from one of three obfuscated...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

MAL-2026-11042 Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

MAL-2026-10578 Malicious code in @sqlite-group/sql-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d3bd76c01604d26251c1650c71f8a99ad32c5389c4e42795477ae660be33a2a The package is published under a scope that impersonates SQLite @sqlite-group and declares itself as "cloud definitions for node", but the shipped...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-11203 Malicious code in @dexwilt/node-fetch (npm)

The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream repository, author, and homepage while publishing under an unrelated scope. Its CommonJS entry point lib/index.js contains the expected node-fetch implementation followed by...

RHCOS 4 : OpenShift Container Platform 4.1 jenkins-2-plugins (RHSA-2019:1636)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1636 advisory. - jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin SECURITY-1322 CVE-2019-10320 -...

Allocation of Resources Without Limits or Throttling

Overview @fedify/vocab-runtime is a Runtime library for code-generated Activity Vocabulary APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the recursive handling of HTTP redirects in the remote and authenticated document loader...

CVE-2026-34148 Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or...

EUVD-2022-5283

Malicious code in bioql PyPI...

Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin

Jenkins Pipeline Remote Loader Plugin before 1.5 provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection...

GHSA-V558-FHW2-V46W Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin

Jenkins Pipeline Remote Loader Plugin before 1.5 provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0 <=1.4.6) +16 more potentially affected by CVE-2022-25178 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5 <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0, =1.0, =1.0, =0.1-beta-5, =1.12.1, =2.2, =1.0.4, =0.1, =1.0, =2.3, =1.0, =1.5 and more Source cves: CVE-2022-25178 Source advisory: OSV:GHSA-5HFV-MG5X-MV32...

CVE-2019-10328

A flaw was found in the Jenkins Workflow Remote Loader plugin. An unsafe whitelist entry was made that allowed invoking arbitrary methods and bypassing sandbox protection. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

A flaw was found in the Jenkins Workflow Remote Loader plugin. An unsafe whitelist entry was made that allowed invoking arbitrary methods and bypassing sandbox protection. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

The vulnerability of the Jenkins Pipeline Remote Loader plugin, related to defects in the data protection mechanism, allows attackers to circumvent sandbox restrictions.

The vulnerability of the Jenkins Pipeline Remote Loader plugin is related to deficiencies in data protection mechanisms. Exploiting this vulnerability allows a malicious actor to bypass sandbox restrictions and execute arbitrary methods remotely...

Sandbox Restrictions Bypass

Jenkins Pipeline Remote Loader Plugin is vulnerable to sandbox restrictions bypass vulnerability. A remote authenticated attacker to bypass security restrictions, caused by an unsafe whitelist entry issue by sending a specially-crafted request...

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

A flaw was found in the Jenkins Workflow Remote Loader plugin. An unsafe whitelist entry was made that allowed invoking arbitrary methods and bypassing sandbox protection. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

A flaw was found in the Jenkins Workflow Remote Loader plugin. An unsafe whitelist entry was made that allowed invoking arbitrary methods and bypassing sandbox protection. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2019-10328

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection...