MAL-2026-13391 Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

MAL-2026-13387 Malicious code in @afasinatickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2eaa8543223afa988f2c6782fb481354f16cafdb28fac01b9221e4c97a2f2f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

kernel security, bug fix, and enhancement update

6.12.0-211.43.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Linux kernel Farsync Function Use-After-Free

The vulnerability of the fstremoveone function in the drivers/net/wan/farsync.c file of the Linux kernel network device driver is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Malicious code in svelte-mapped-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666d747ec06fa428dfb0f21867e6001b52450fee1770061dcd9bd0ec9e3731fa [email protected] shows no evidence of credential access, install-time or import-time code execution from remote sources, silent relay of...

MAL-2026-13384 Malicious code in svelte-mapping-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76203390ecd481ea969ede1996712ca380655fb041c051d50696b2f8f3dd9265 No a static rule matches and no traced code paths indicating credential access, exfiltration, install-time remote code execution, silent-relay,...

Malicious Package

Overview sso-tramvai-lib-roles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

K000162799: Linux Kernel vulnerability CVE-2026-63798

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe and sets up chained handlers...

MAL-2026-13385 Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

Malicious code in poly-provider-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef76fc9ad34b0c2f608bd61904deec5355ffe02b045eecf233e70e989ce0260 No a static rule matches were produced for this package version, and traced-code findings are not available in a parseable form. The package's actual...

GL.iNet GL-MT3000 Router Command Injection

The vulnerability of the removeprofile function at the /cgi-bin/glc endpoint of the modem.so component of the GL.iNet GL-MT3000 router software lies in the lack of measures to sanitize input data. Exploiting this vulnerability could allow an attacker to inject arbitrary commands remotely...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Malicious code in @jsimplify/errno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb95765882f33f9d81fcfd6fe88ba4c274421923511121b7e9413e77c1dc69d The package declares a scripts.install hook that spawns bun index.js detached and unref'd on npm install, and pulls in bun as a declared dependency t...

MAL-2026-12006 Malicious code in @jsimplify/errno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb95765882f33f9d81fcfd6fe88ba4c274421923511121b7e9413e77c1dc69d The package declares a scripts.install hook that spawns bun index.js detached and unref'd on npm install, and pulls in bun as a declared dependency t...

MAL-2026-12026 Malicious code in cors-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e391c8883796e10e6d74a96311f18f2a083b2745a6bd6cae8a3d7acc61d277 The CommonJS entry src/index.cjs exports getPlugin, which performs an HTTPS GET to the hardcoded host astonishing-torrone-ffb31e.netlify.app with TLS...

Malicious code in cors-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e391c8883796e10e6d74a96311f18f2a083b2745a6bd6cae8a3d7acc61d277 The CommonJS entry src/index.cjs exports getPlugin, which performs an HTTPS GET to the hardcoded host astonishing-torrone-ffb31e.netlify.app with TLS...

CVE-2026-18787

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...