CVE-2026-24742 Discourse staff action logs expose sensitive information to moderators

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...

CVE-2026-24742 Discourse staff action logs expose sensitive information to moderators

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...

CVE-2026-24742

Discourse (open‑source discussion platform) is affected in CVE-2026-24742 for versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The issue allows non‑admin moderators to view sensitive data in staff action logs that should be restricted to administrators, exposing webhook URLs and secre...

Malicious code in lvldragdrop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ce81a159192ad7b893014354e6d4e99dd61e918b75bf4a1c2e787d3373aa26 The package lvldragdrop was found to contain malicious code. Source: ghsa-malware 78a2a28643bce407d3eb1ba2f9524eb15c5bdf4879ffb0cc93e0ccef865fab26 An...

MAL-2026-592 Malicious code in lvldragdrop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ce81a159192ad7b893014354e6d4e99dd61e918b75bf4a1c2e787d3373aa26 The package lvldragdrop was found to contain malicious code. Source: ghsa-malware 78a2a28643bce407d3eb1ba2f9524eb15c5bdf4879ffb0cc93e0ccef865fab26 An...

Malicious code in kol7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a81ab7bff0ce4494ac98d492444f18a8ec22e0d34f4cbaa30314de910b6a1039 The package kol7a was found to contain malicious code. Source: ghsa-malware 34930716d17313165d83a1830db1542583fbd4c6e6cf873c66cb3dfb5fbfb336 Any...

Malicious Package

Overview keeper-secrets-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in chai-as-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1dda9ad39b1f120fc9fe5a856dbc209c2441a9c6de305ae72a35ec94ef31862 The package chai-as-extended was found to contain malicious code. Source: ghsa-malware c852649226583defd7fce57e5a82645ae50eeff8376ea06c070170b31c0a66...

Malicious code in dotenv-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbecb8b9bb96fcd71af0764df5106d8163ccb94c21960bf858383ab85d10308 The package dotenv-embed was found to contain malicious code. Source: ghsa-malware eb5a7942b654b4da1fb16e67f19ca82b3b52c4fcce4db85e9d5596571651c6b7 A...

Malicious code in chai-async-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fe54f3f00b12c9b57fd672be7ddbe4a46342c24fe308c31f31c6156ae436d8b The package chai-async-tests was found to contain malicious code. Source: ghsa-malware 4303ac7ff339f51dfbc53ed8c70cd02a76123b62e0448bca935128fd313ab3...

MAL-2026-589 Malicious code in dotenv-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbecb8b9bb96fcd71af0764df5106d8163ccb94c21960bf858383ab85d10308 The package dotenv-embed was found to contain malicious code. Source: ghsa-malware eb5a7942b654b4da1fb16e67f19ca82b3b52c4fcce4db85e9d5596571651c6b7 A...

MAL-2026-585 Malicious code in chai-async-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fe54f3f00b12c9b57fd672be7ddbe4a46342c24fe308c31f31c6156ae436d8b The package chai-async-tests was found to contain malicious code. Source: ghsa-malware 4303ac7ff339f51dfbc53ed8c70cd02a76123b62e0448bca935128fd313ab3...

Malicious code in chai-sub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9fb8daf2c61a42d820b2e0f8a846b9f2c95ed6a1cdc4c19a7d80f3398b4a21 The package chai-sub was found to contain malicious code. Source: ghsa-malware 94d4e0fa1548915ba6f77782a735206056554990f47f65aadc5781a23474b855 Any...

MAL-2026-588 Malicious code in chai-sub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9fb8daf2c61a42d820b2e0f8a846b9f2c95ed6a1cdc4c19a7d80f3398b4a21 The package chai-sub was found to contain malicious code. Source: ghsa-malware 94d4e0fa1548915ba6f77782a735206056554990f47f65aadc5781a23474b855 Any...

Malicious code in chai-px (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfeac68ac3a89859c0a6c38e5d55e4e2e9b9ffa77476a10cdc1d31de070bea68 The package chai-px was found to contain malicious code. Source: ghsa-malware 708ec6326dbafd483773c64035513b5cd8be0a0842c3d44d92af9eee01408b8a Any...

MAL-2026-587 Malicious code in chai-px (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfeac68ac3a89859c0a6c38e5d55e4e2e9b9ffa77476a10cdc1d31de070bea68 The package chai-px was found to contain malicious code. Source: ghsa-malware 708ec6326dbafd483773c64035513b5cd8be0a0842c3d44d92af9eee01408b8a Any...

Malicious code in chai-chains-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f83118d80cc6575c1c629c8591ed8a6a7a34ea03591cb737cdfb6ac45f0738 The package chai-chains-async was found to contain malicious code. Source: ghsa-malware...

Malicious code in somsodamsd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437d384f1bedaaf93abee9ecf1219d3244c96b0086ec0ed005374d28fb9d4522 The package somsodamsd was found to contain malicious code. Source: ghsa-malware ffb9c516d18ccedc5e8858843b9cfe1507126bf2d577896d21391b4f0d211a9c Any...

MAL-2026-582 Malicious code in somsodamsd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437d384f1bedaaf93abee9ecf1219d3244c96b0086ec0ed005374d28fb9d4522 The package somsodamsd was found to contain malicious code. Source: ghsa-malware ffb9c516d18ccedc5e8858843b9cfe1507126bf2d577896d21391b4f0d211a9c Any...

MAL-2026-579 Malicious code in skndkjasndkjan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db684638c7c4cc14bc030fa38952c5a81da5ae4fbfc4d8a7279f52096db4299 The package skndkjasndkjan was found to contain malicious code. Source: ghsa-malware b3faa645d3b9d269340718ff8ee7b86fa018985ce3748a7619a156fbec8fce44...