MAL-2026-1926 Malicious code in tokenshower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31db2e66d226160d10fe5f31a29d7b95cba1d0751cc575c0cf6130679170c7a The package tokenshower was found to contain malicious code. Source: ghsa-malware f9fdcfed91dfe75ee3b371ba973a183f42ff3085a29be233f33b5e34249d18cf An...

MAL-2026-1925 Malicious code in jsonify-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef3f7d9cb714309502cac987c904c29a8eda1fda1fcd8f5fffabfa339a64369 The package jsonify-parser was found to contain malicious code. Source: ghsa-malware 4d17ffa1ebe907cee2cc4cf5fd22ab76acd112213237bcac49b62b06a002c1cb...

CVE-2026-23268 apparmor: fix unprivileged local user can do privileged policy management

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened...

Malicious code in chai-as-constrained (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea5f87c9fffb9b32d6390a3922c9a8bfc616a693910c9a8d7599cfa8ef11c9e9 The package chai-as-constrained was found to contain malicious code. Source: ghsa-malware...

PT-2026-28434

Name of the Vulnerable Software and Affected Versions Flannel versions prior to 0.28.2 Description Flannel, a network fabric for containers designed for Kubernetes, contains a command injection issue in its experimental Extension backend. An attacker who can set Kubernetes Node annotations can...

MAL-2026-1493 Malicious code in pino-logger-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c908d1d5a0d2a6a517ef1aa6e7ab5b7ddc8644dc39730c2629f0226a69121a The package pino-logger-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in pino-logger-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c908d1d5a0d2a6a517ef1aa6e7ab5b7ddc8644dc39730c2629f0226a69121a The package pino-logger-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1492 Malicious code in strapi-plugin-workspace-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360f06861421eccfdc69a5f18ecfe67b3785cb24bb1b0d1e6dd3f5d65df20f20 The package strapi-plugin-workspace-plugin was found to contain malicious code. Source: ghsa-malware...

Malicious code in strapi-plugin-workspace-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360f06861421eccfdc69a5f18ecfe67b3785cb24bb1b0d1e6dd3f5d65df20f20 The package strapi-plugin-workspace-plugin was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1489 Malicious code in asset-delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff566136dd4e76e6bc8da12a23345712a57b375d3d0586ee36922cc0ffbbf880 The package asset-delivery was found to contain malicious code. Source: ghsa-malware ce9daf86327543018f44899bd8967bf2b927d6f1d9267b6726281b5ea0765868...

Malicious code in asset-delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff566136dd4e76e6bc8da12a23345712a57b375d3d0586ee36922cc0ffbbf880 The package asset-delivery was found to contain malicious code. Source: ghsa-malware ce9daf86327543018f44899bd8967bf2b927d6f1d9267b6726281b5ea0765868...

Malicious code in graphlib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc5e5e2ae1439a28be92e99758c3253bf2bd09a568712a5d0725553b4836eaf The package graphlib-js was found to contain malicious code. Source: ghsa-malware 375768659fc55b18acf652226fabd9052c10c4f88d36f150317532bc8661df13 An...

MAL-2026-1491 Malicious code in graphlib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc5e5e2ae1439a28be92e99758c3253bf2bd09a568712a5d0725553b4836eaf The package graphlib-js was found to contain malicious code. Source: ghsa-malware 375768659fc55b18acf652226fabd9052c10c4f88d36f150317532bc8661df13 An...

GHSA-MW24-F3XH-J3QV Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Impact Due to a mis-written NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of...

Malicious code in supply-hx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731dffe7bbd70b529730211e15a152420c28b79f76935d387ccff327ef587a5e The package supply-hx was found to contain malicious code. Source: ghsa-malware 0429944ee7a172b223c738e5da756b2a0713f9dc076dd13047a5726ee2528bb0 Any...

MAL-2026-1476 Malicious code in jalalstealer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18913d1d0805eb9183a23aedfba3cbef762c642f82c079dd24711102fd20951e The package jalalstealer was found to contain malicious code. Source: ghsa-malware d760ddb75dc632737c4e778e0ac4db4522bd8584240834cbefe9bffa1948999c A...

Malicious code in aesdecryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ac66c3676fdc79338dd38b32cacdd68d6f86e097c163eb1e8e4bd556de82c69 The package aesdecryptor was found to contain malicious code. Source: ghsa-malware 67de86e4e1b93130bb4f76480f236f202b1f257067eaf1ca02d3c565c2fc8edb A...

Malicious code in jalalstealer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18913d1d0805eb9183a23aedfba3cbef762c642f82c079dd24711102fd20951e The package jalalstealer was found to contain malicious code. Source: ghsa-malware d760ddb75dc632737c4e778e0ac4db4522bd8584240834cbefe9bffa1948999c A...

Malicious Package

Overview aesdecryptor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in wordpecker-fx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d02b17de27c1b9af727c67a5b24127118687a1ba6ce1c11e7aa7eb0f268fc741 The package wordpecker-fx was found to contain malicious code. Source: ghsa-malware 402a742fcb1e315f799df41aa02111a85a415621d90b7e15ebc3d2398f528e92...