6304 matches found
Malicious code in @finaxis/common-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f708a31239d3dc7490906a4a41f5ccb3cb76c99f89bc87b5ad5884939bb2d308 Package is published with a README copied from lodash v4.18.1 and keywords 'lodash','lodash-js', but the sole shipped module dist/common-js.js is a...
Malicious code in fastly-vcl-language-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...
Malicious code in hunterone-build-probe-9210 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e probe.js runs automatically via package.json preinstall and postinstall hooks "node probe.js || true". On execution it collects os.hostname,...
Malicious code in gunzip-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb01fea066eb17256cd8a5ef589351ca7c5fda77eaff201237eac8f306b5b53d The OpenSSF Package Analysis project identified 'gunzip-js' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...
WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...
GHSA-XPHW-4F88-5F39 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips, prometheus-mongodb-exporter, hugo-fips, yace-fips, crossplane-provider-aws-lexmodels-fips, gitlab-kas-fips, crossplane-provider-aws-glue-fips, grafana-pyroscope-fips, kiam, crossplane-provider-aws-connect, crossplane-provider-aws-appmesh-fips,...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, bazelisk, gitlab-operator-fips, steampipe, prometheus-mongodb-exporter, hugo-fips, yace-fips, crossplane-provider-aws-lexmodels-fips, gitlab-kas-fips, crossplane-provider-aws-glue-fips, grafana-pyroscope-fips, kiam,...
GHSA-C974-W86C-VPFW vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, gitlab-operator-fips, steampipe, prometheus-mongodb-exporter, crossplane-provider-aws-lexmodels-fips, gitlab-kas-fips, crossplane-provider-aws-glue-fips, grafana-pyroscope-fips, kiam, crossplane-provider-aws-connect,...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: trufflehog, aws-signer-notation-plugin, tailscale, kubernetes-dashboard-api, cadvisor, sriov-network-device-plugin, gobuster, grafana-operator, openbao-k8s, nova, tetragon, ferretdb, kubernetes-dns-node-cache, spegel, cloudnative-pg, polaris, nri-nginx,...
GO-2026-6089 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips, prometheus-mongodb-exporter, hugo-fips, yace-fips, crossplane-provider-aws-lexmodels-fips, gitlab-kas-fips, crossplane-provider-aws-glue-fips, grafana-pyroscope-fips, kiam, crossplane-provider-aws-connect, crossplane-provider-aws-appmesh-fips,...
CVE-2026-47192 kas's late signature validation may allow unnoticed repository manipulations
kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...
MAL-2026-14042 Malicious code in @devmikets/hyperliquid-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...
Malicious code in @demopack/www (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...
GO-2026-5711 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tekton-pipelines-fips, tekton-chains-fips, tkn, tkn-fips...
GO-2026-5486 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tekton-pipelines-fips, tekton-chains-fips, tkn, tkn-fips...
GO-2023-1901 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-pipelines-fips...
GO-2026-5558 vulnerabilities
Vulnerabilities for packages: opentofu, opentofu-fips...
GO-2024-2907 vulnerabilities
Vulnerabilities for packages: nuclei...