MAL-2026-665 Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

Malicious code in typed-document-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aee62441fa4b75c4aee1044c18d8043570ba9e43b3034ce3ea6ae70aabf8373 The package typed-document-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-663 Malicious code in transform-async-generator-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338773642b9997fc33cd7f4eb7cfbca20019115fc184de55077b8b112a45dcc4 The package transform-async-generator-functions was found to contain malicious code. Source: ghsa-malware...

Malicious code in transform-async-generator-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338773642b9997fc33cd7f4eb7cfbca20019115fc184de55077b8b112a45dcc4 The package transform-async-generator-functions was found to contain malicious code. Source: ghsa-malware...

MAL-2026-666 Malicious code in transform-react-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad21ba0cb042f576642dd61d0639ac6da6cec5a468ff7b5cf0aab9164667bcb0 The package transform-react-display-name was found to contain malicious code. Source: ghsa-malware...

MAL-2026-661 Malicious code in netlify-project-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2c95931ae7b5a6c572ebecb2cd096bd4cef37bcf61a440cbb2338062f4a836 The package netlify-project-helper was found to contain malicious code. Source: ghsa-malware...

MAL-2026-660 Malicious code in dns-troubleshoot-toolkit-xyz123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d7149f6ef706cf3aa58e9dbf0b206aec334710d6d960fc3d1336f7b67bd56e The package dns-troubleshoot-toolkit-xyz123 was found to contain malicious code. Source: ghsa-malware...

Malicious code in ansi-universal-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa5e839c2761f91f4d422c6c89799495ba4a3171731ecac75e00647bbf95904 The package ansi-universal-ui was found to contain malicious code. Source: ghsa-malware...

Malicious code in vite-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dde7d42b0bc5236d827ba62c883fbf14b643e368ef8a4b0f7b5430a35183254 The package vite-ui-components was found to contain malicious code. Source: ghsa-malware...

MAL-2026-669 Malicious code in vite-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dde7d42b0bc5236d827ba62c883fbf14b643e368ef8a4b0f7b5430a35183254 The package vite-ui-components was found to contain malicious code. Source: ghsa-malware...

Malicious code in atg-atgse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4a895bff954a7aac56b4897d5f8582caded83251256152d5f9b7d55a53eedca The package atg-atgse was found to contain malicious code. Source: ghsa-malware c7041c7bfbb06e2e710b58e8aeff432e4774d756db057975426c046c7ea06339 Any...

MAL-2026-659 Malicious code in atg-atgse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4a895bff954a7aac56b4897d5f8582caded83251256152d5f9b7d55a53eedca The package atg-atgse was found to contain malicious code. Source: ghsa-malware c7041c7bfbb06e2e710b58e8aeff432e4774d756db057975426c046c7ea06339 Any...

MAL-2026-662 Malicious code in researchpoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ee8d68b9386bf55de2d3ed033493507ee88db166ae46345172ba93d938f3a27 The package researchpoc was found to contain malicious code. Source: ghsa-malware 912631f8dc76f3b4ddae075966fd902e7ab19c0799a0cd29b0c9ece7d79cd1ce An...

MAL-2026-657 Malicious code in react-dnd-legacy-html5-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d549162491e3ef2900daafc0bb49291caef1538d4406a75ec4b80e12ac18fc26 The package react-dnd-legacy-html5-backend was found to contain malicious code. Source: ghsa-malware...

Malicious code in jshint-groups (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf7ad9a58a15b025d84def4a32761ec77338fbcda7ef3ae459602eacfaf4595 The package jshint-groups was found to contain malicious code. Source: ghsa-malware fe1d6fde4a749fdb784071c856d26761b12fdceffae0020f2492a4a845eb04f4...

MAL-2026-656 Malicious code in jshint-groups (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf7ad9a58a15b025d84def4a32761ec77338fbcda7ef3ae459602eacfaf4595 The package jshint-groups was found to contain malicious code. Source: ghsa-malware fe1d6fde4a749fdb784071c856d26761b12fdceffae0020f2492a4a845eb04f4...

PT-2026-6506

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

CVE-2026-24512: Improper Input Validation

A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note tha...

BIT-DISCOURSE-2026-24742 Discourse staff action logs expose sensitive information to moderators

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...