Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

Malicious code in @vaultflow/update-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13662163c9d2e7a11d10165b3c16e0b74f8fcc91b9dc3c4cd994e68914a6dae0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a45490446ee8d16ef3eec35619feeb7cfc2a870de4d2db869e65999ff39baa5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3e452fd66c689c6ac38c2bc8b7db35db15202a7b921659ca48c8ed352381c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef1d43e872519f6b1865d149c6f202e9079165bc28c12645e8154155d61e7455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b53f3137f847d7234a065286565e0112a828bb14dd580d6ea46a9c262397294 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 832cecce176cee15be4875642bd875636a40159560e29bd359746b2c80359e10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11099 Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dac7edbd7a941a69901501e2f602b37a483dde93aac9af9270f146fea0e7992 The package advertises itself as a date parser but the public API demoParseDate performs several unrelated hostile actions against the calling...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 493d92c75a6ab0daa328300c9f6a6b177a8a4fd656b8f0431f60e11f1ef3e060 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44ccc8950e5ba2f4445eb663dafe54d1abf35fc0af58cb14d449fa66ccb26a38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11052 Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b8c073af489e9e7102ec43ca525f91f88615b572d4d0b0e65c6b64b647f93ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11034 Malicious code in eth-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a547e155b232bc3164db9fc1f7de92bf70a5f1ad02e277a6c9b272d47f48e00d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11039 Malicious code in yuinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d036e3cc02bd090bae9ff004d7559fd524b963bb47fee0a0a6cd6baf1395c2be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11038 Malicious code in svelte-streak-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5b8b3f2004d4b7fc0d461cf156a56b761cd77ed98c7023af0a012467786747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

MAL-2026-11036 Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

MAL-2026-11035 Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de490c11cc710f708308f5078272e948fc7824c535576ab37001b9d874d35e22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11037 Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e778109e3800d6e2c265494be646061aa4d3d109a7ce8d423e915acab664c181 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...