6307 matches found
MAL-2026-14065 Malicious code in akamai-sensor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...
Malicious code in @finaxis/common-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f708a31239d3dc7490906a4a41f5ccb3cb76c99f89bc87b5ad5884939bb2d308 Package is published with a README copied from lodash v4.18.1 and keywords 'lodash','lodash-js', but the sole shipped module dist/common-js.js is a...
Malicious code in fastly-vcl-language-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...
Malicious code in hunterone-build-probe-9210 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e probe.js runs automatically via package.json preinstall and postinstall hooks "node probe.js || true". On execution it collects os.hostname,...
Malicious code in gunzip-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...
Malicious code in depcruise-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...
MAL-2026-14054 Malicious code in depcruise-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...
WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...
GHSA-XPHW-4F88-5F39 vulnerabilities
Vulnerabilities for packages: sonobuoy, crossplane-provider-aws-securityhub, hubble-fips, kapp-controller-fips, nodetaint-fips, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, mailpit, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips,...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...
GHSA-C974-W86C-VPFW vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-securityhub, hubble-fips, azurefile-csi, kapp-controller-fips, rancher-system-agent, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, plutono, cluster-api, crossplane-provider-aws-mediastore,...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, grafana-rollout-operator, kubescape, xeol, tetragon, pvc-autoresizer, kube-vip, k6, sbomqs, thanos-operator, kserve-rest-proxy, octo-sts, nginx-prometheus-exporter, ip-masq-agent, git-lfs, cloudnative-pg, sftpgo, delve, descheduler, dive,...
GO-2026-6089 vulnerabilities
Vulnerabilities for packages: sonobuoy, crossplane-provider-aws-securityhub, hubble-fips, kapp-controller-fips, nodetaint-fips, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, mailpit, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips,...
CVE-2026-47192 kas's late signature validation may allow unnoticed repository manipulations
kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...
MAL-2026-14042 Malicious code in @devmikets/hyperliquid-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...
Malicious code in @demopack/www (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...
GO-2026-5711 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tkn, tkn-fips, tekton-pipelines-fips, tekton-chains-fips, tekton-chains...
GO-2026-5486 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tkn, tkn-fips, tekton-pipelines-fips, tekton-chains-fips, tekton-chains...