CLSA-2026-1785952964 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 14 CVEs. Fixed in 6.2.15-tuxcare.3...

CLSA-2026-1785932316 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 3 CVEs. Fixed in 6.1.21-tuxcare.8...

CLSA-2026-1781571271 TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 10 CVEs. Fixed in 6.1.21-tuxcare.7...

CLSA-2026-1779410898 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.21-tuxcare.6...

Malicious code in @wagni_bot/wagni (npm)

The npm package @wagnibot/wagni is a supply-chain credential stealer disguised as a the campaign's own namesake handle SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/polygon (npm)

The npm package @wagnibot/polygon is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-11112 Malicious code in @wagni_bot/metamask (npm)

The npm package @wagnibot/metamask is a supply-chain credential stealer disguised as a MetaMask SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-11110 Malicious code in @wagni_bot/eth (npm)

The npm package @wagnibot/eth is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-11113 Malicious code in @wagni_bot/opensea (npm)

The npm package @wagnibot/opensea is a supply-chain credential stealer disguised as a OpenSea SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-6774 Malicious code in @marketfront/devtoolsloader (npm)

The @marketfront/devtoolsloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...