MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11018 Malicious code in veldora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a848da2622d0adc27e55e1a650c39892aea7ef22c81c4c6ed4e5b6dc64809de Package [email protected] was scanned across 6 files. No evidence of install-time or import-time execution of remote content, no credential or environmen...

MAL-2026-10983 Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...

MAL-2026-10988 Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 CVSS score: 9.8, a critical deserialization of untrusted data in Microsoft Office SharePoint tha...

MAL-2026-10987 Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...

MAL-2026-10928 Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da6be7241858aacc6bf0fdef363fad9469efcbd9414b7b6e3e4153eba341f7b The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a fullscreen iframe, and...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

MAL-2026-10922 Malicious code in lambda-cloudwatch-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

MAL-2026-10839 Malicious code in @gocortexio/npmgremlinbox-mpl-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fee530f600c3dda2f184f9f4cbeb4dbe23b98fa5c6e426e89afceffadce4175d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10854 Malicious code in @gocortexio/npmgremlinbox-typosquat-commander (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c49af3974e2d4e9ac4f2118230b82c0fbcca062f8b45fa85b792ab6deb516787 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10848 Malicious code in @gocortexio/npmgremlinbox-simpl-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19cca0040a0e06465540014785a7885bdcb84de6915594fc7b1802db431e67ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10844 Malicious code in @gocortexio/npmgremlinbox-polyform-noncommercial-1-0-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 468bf7ae3a725d97b503a456cd1c3baa627f82d8798b6ce91acad9f0dd20e9e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10806 Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-2-1-jp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66b1f86538204c3996ab56915ddff5fcd4dc9f0606c097cd3d03e17c8e89c4ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10803 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-igo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad0f72a8295e2a43e599a9b2afbc64201b6b7ca56c9b4f2161ddc07f3f25120 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10781 Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

Malicious code in axios-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...