MAL-2026-2614 Malicious code in upstart.previewcss (npm)

Package is malware. It collects and exfiltrates sensitive data SSH keys, credentials, environment variables and system info to a remote server. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd2d5c329f24c54ca68ce21884867d6b4db6ae64d0e2041af60deb2203cc8830 The...

Malicious code in pinstatsd (npm)

Package is malware due to data exfiltration to multiple domains via DNS and HTTPS, along with a suspicious preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ae52dde0a4efddd6d12bc4795b77da5433cb750b4ddb852f1aca27ea457e The package pinstatsd w...

MAL-2026-2654 Malicious code in pinstatsd (npm)

Package is malware due to data exfiltration to multiple domains via DNS and HTTPS, along with a suspicious preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ae52dde0a4efddd6d12bc4795b77da5433cb750b4ddb852f1aca27ea457e The package pinstatsd w...

Malicious code in pinlogger (npm)

The package is a malware due to system info exfiltration via DNS/HTTPS to OAST domains and arbitrary code execution during preinstall. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e78bb72f47ecca78511d87a17bea5f38fb4897dbc117433dfd7667cd97a51d0 The package...

MAL-2026-2653 Malicious code in pinlogger (npm)

The package is a malware due to system info exfiltration via DNS/HTTPS to OAST domains and arbitrary code execution during preinstall. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e78bb72f47ecca78511d87a17bea5f38fb4897dbc117433dfd7667cd97a51d0 The package...

Malicious code in wm-plugin-visions-recorder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9fc7d1b94e873a6acaa539c03b3deb578141de07e79343acb659b17d4815077 The package wm-plugin-visions-recorder was found to contain malicious code. Source: ghsa-malware...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux, victoriametrics, dataplaneapi, temporal, goreleaser, pluto, malcontent, clickhouse-operator, flux-image-automation-controller, flux-image-reflector-controller, actions-runner-controller, envoy-ratelimit, ingress-nginx-controller, aws-network-policy-agent,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: helm-set-status, flux-source-watcher-fips, juicefs, act, gitlab-operator, prometheus-elasticsearch-exporter, kubernetes-csi-node-driver-registrar-fips, localstack, kind, cilium-envoy, amazon-ecs-agent, weaviate, prometheus-mongodb-exporter, bom, external-dns,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: helm-set-status, flux-source-watcher-fips, juicefs, act, gitlab-operator, prometheus-elasticsearch-exporter, kubernetes-csi-node-driver-registrar-fips, localstack, kind, cilium-envoy, amazon-ecs-agent, weaviate, prometheus-mongodb-exporter, bom, external-dns,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, kyverno-policy-reporter-plugins-trivy-fips, helm-set-status, vault-k8s-fips, authservice-fips, cilium-certgen, crossplane-function-go-templating-fips, flux-source-watcher-fips, cert-manager-istio-csr-fips, influx, juicefs,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, kyverno-policy-reporter-plugins-trivy-fips, helm-set-status, vault-k8s-fips, authservice-fips, cilium-certgen, crossplane-function-go-templating-fips, flux-source-watcher-fips, cert-manager-istio-csr-fips, influx, juicefs,...

EUVD-2026-21176

PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars Bypassing shell=False in Shell Tool...

CVE-2026-39943

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records in directusrevisions whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline,...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

MAL-2026-2588 Malicious code in @lamoda/seller-ui-kit (npm)

Malicious package with preinstall script executing a file that gathers sensitive data and exfiltrates it to a suspicious domain. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec0cd5c3b13d6c0355868de10ce8ebcf855a28254251280b38743e860217f98 The package...