Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

MAL-2026-14209 Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

MAL-2026-14211 Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

MAL-2026-14208 Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

Malicious code in chaikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4 The package's main entry index.js unconditionally requires./lib/config, a 4MB obfuscator.io-style file RC4 string-array decoder with 23,902 entries,...

MAL-2026-14201 Malicious code in chaikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4 The package's main entry index.js unconditionally requires./lib/config, a 4MB obfuscator.io-style file RC4 string-array decoder with 23,902 entries,...

Malicious code in tailwind-custom-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720 The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an...

MAL-2026-14197 Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

PT-2026-78548

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A double quote in a header parameter name is emitted into the generated request-validation...

PT-2026-78315

Name of the Vulnerable Software and Affected Versions Net::OAuth versions prior to 0.33 Description The software performs signature verification for HMAC-SHA1, HMAC-SHA256, and PLAINTEXT using a non-constant-time comparison in the verify function. Specifically, the eq operator is used to compare...

Linux Distros Unpatched Vulnerability : CVE-2026-18695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write...

PT-2026-79923

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

MAL-2026-14141 Malicious code in test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0397c2435e4a2a4b33ec6cc8e396eacfa099aea042b3da6e70d96d86ea53a460 The package's preinstall lifecycle hook runs node index.js, which shells out to collect installer host identifiers hostname, cwd, whoami and the...

CVE-2026-12632 Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

Zephyr's Precision Time Protocol receive handler ptpmsgpostrecv in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptpmsgtype msg-header.typemajorsdoid & 0xF, range 0-15 and uses it to index the msgsize table. That table only defines entries up to PTPMSGMANAGEMENT...

SUSE-SU-2026:23193-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

CVE-2026-50161

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websockdecode function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expressi...

UBUNTU-CVE-2026-50161

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websockdecode function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expressi...