Malicious Package

Overview discord-mfa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

MAL-2026-15562 Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

SUSE CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/hooks/:id/test endpoint. The endpoint accepts arbitrary URLs without host validation, allowing tenant administrators holding Management API tokens to issue HTTP POST requests to internal services on ...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

EUVD-2026-67793

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

MAL-2026-15274 Malicious code in secure-test-browser-2o7y1f6z (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faa90dad13634f3249de9e8074837d41b4ab76babbdd2f51a3d27dc70786b9e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15278 Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15471 Malicious code in secure-test-browser-zufp4hzx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3584ec9f6e16770b1c8630b232add013816916ad9006635b584ae3995a64f6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15460 Malicious code in secure-test-browser-yp88o07w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fcdde9a08c190c554d2681d2eb758290d0c6f58d3cb7b4504cb1c9502d893fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15400 Malicious code in secure-test-browser-nxottb5j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29a89a6eb548cd54a4b641ba83437462950bb294ae1dd7faed2256b82dc79806 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15343 Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15317 Malicious code in secure-test-browser-bph71q7u (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ba1ffa1c0eaf6f918e2b77fd4ae5eacf0b90084f53d0024f671079e03479197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...