Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

Malicious code in proc_macro1 (crates.io)

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...

Malicious code in proc_macro_en (crates.io)

proc-macro-en is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carryin...

CVE-2026-76139 Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-75569

mce-operator-bundle (Red Hat) contains a build-time supply chain flaw: the bundle-generation process fetches business logic from the mutable branch stolostron/release@master without commit pinning or signature verification. An attacker with write access to that remote repository can inject arbitr...

Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

Malicious code in no-for-of-loops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...

Malicious code in ranux-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2 package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant...

Malicious code in npm-wold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...

Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

PT-2026-78703

Name of the Vulnerable Software and Affected Versions acm-operator-bundle affected versions not specified Description The build process for this component downloads and executes a script from a remote source without verifying its authenticity or integrity. This allows a remote attacker to inject...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

MAL-2026-14125 Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-77162

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description Insufficient validation of the allow shell configuration parameter within project config files allows for arbitrary shell command execution. An attacker can achieve this by committing a malicious...

Malicious code in sui-move-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cceb15de1ddd23a55de69afe59a00c79dcc23f8ce3dfed33592d781bddfbb5a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14106 Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in @siwatfa/yorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

glassworm-hunter v1.0.4

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...