TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor , spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22,...

[SECURITY] Fedora 42 Update: aw-server-rust-0.14.0^20260516.gitdf49b3d-1.fc42

A re-implementation of aw-server in Rust...

[SECURITY] Fedora 43 Update: aw-server-rust-0.14.0^20260516.gitdf49b3d-1.fc43

A re-implementation of aw-server in Rust...

[SECURITY] Fedora 44 Update: aw-server-rust-0.14.0^20260516.gitdf49b3d-1.fc44

A re-implementation of aw-server in Rust...

Cargo 安全漏洞

Cargo is a Rust package manager open-sourced by The Rust Programming Language. A security vulnerability exists in Cargo that stems from the incorrect handling of symbolic links in a crate tarball downloaded from a third-party registry, which could lead to a malicious crate overwriting the source...

Fedora 42 : aw-server-rust / awatcher / nodejs-aw-webui (2026-7047e2fec5)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-7047e2fec5 advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Fedora 44 : aw-server-rust / awatcher / nodejs-aw-webui (2026-f4ddcfa64b)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f4ddcfa64b advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Fedora 43 : aw-server-rust / awatcher / nodejs-aw-webui (2026-c9d4e8b9a4)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c9d4e8b9a4 advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Malicious Package

Overview defi-risk-scanner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package was linked to a supply chain attack and contained code designed to steal developer secrets, crypto wallets, SSH keys, and cloud...

Malicious Package

Overview solidity-build-guard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package was linked to a supply chain attack and contained code designed to steal developer secrets, crypto wallets, SSH keys, and cloud...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +9 more potentially affected by CVE-2026-46673 via russh-cryptovec (0.7.3)

russh-cryptovec CARGO version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on russh-cryptovec and may be impacted: - assistantdaemon 0.1.0 - async-ssh2-tokio =0.2.0, =0.1.0, =0.1.0, =0.34.0-beta.1, =0.22.0-beta.1, =0.2.0, =0.1.0, =0.4.1 - sshrpc...

monerochan-stark (>=5.2.2, <=5.2.12), p3-circle (>=0.1.0, <=0.3.3-succinct) +20 more potentially affected by CVE-2026-46654 via p3-challenger (>=0.1.0, <=0.3.3-succinct)

p3-challenger CARGO version =0.1.0, =5.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.5-succinct, =0.1.0, =0.1.0, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.2.1 and more Source cves: CVE-2026-46654 Source advisory: OSV:GHSA-VJ64-RJF3-W3V7...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +15 more potentially affected by CVE-2026-46539 via nimiq-primitives (0.1.0)

nimiq-primitives CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-primitives and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

atm0s-media-server-transport-rtmp (0.1.0), audio-opus-bsd (>=0.1.0, <=0.1.2) +37 more potentially affected by unknown CVE via audiopus_sys (>=0.1.8, <=0.2.2)

audiopussys CARGO version =0.1.8, =0.1.0, =0.1.0, =0.24.0, =0.3.0, =0.4.0, =0.1.0, =0.1.1-alpha, =0.1.0, =0.2.0, =1.2.0, =1.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0150...

libcrux-digest (>=0.0.4-pre.1, <=0.0.8), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +10 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.9-rc.1)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =1.20.4, =0.2.0, =0.4.3, =0.8.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0208...

[SECURITY] Fedora 43 Update: rust-nu-0.99.1-17.fc43

A new type of shell...

[SECURITY] Fedora 43 Update: rustup-1.29.0-4.fc43

Manage multiple rust installations with ease...

[SECURITY] Fedora 44 Update: rust-nu-0.99.1-17.fc44

A new type of shell...

[SECURITY] Fedora 44 Update: rustup-1.29.0-4.fc44

Manage multiple rust installations with ease...

PT-2026-42815

Name of the Vulnerable Software and Affected Versions wasmtime-wasi affected versions not specified Description An access control mechanism bypass exists when a filesystem preopen is configured with DirPerms::all and FilePerms::READ without FilePerms::WRITE. This allows bypassing restrictions by...