MAL-2026-10080 Malicious code in webrix-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname,...

MAL-2026-10041 Malicious code in chai-as-buffered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a [email protected] is a typosquat lure name resembles chai-as-promised; README and module exports impersonate the pino logger whose actual...

MAL-2026-10049 Malicious code in chai-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...

MAL-2026-10056 Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...

Malicious code in chai-as-thread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69f1826d6866410cdfe11e20cff630d3f0118d48c0cc9f697297aa64d29b341 On require, the package spawns a detached node child that runs lib/initializeCaller.js. That script decodes a base64-obscured URL...

CVE-2026-15189

The vulnerability CVE-2026-15189 affects aerostackdev aerostack-mcp (mcp-whatsapp component). The issue is in the upload_media function where manipulation of the media_url argument enables server-side request forgery (SSRF). The records indicate the attack could be launched remotely, with no vers...

CVE-2026-15189 aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery

A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23. Affected by this issue is the function uploadmedia of the component mcp-whatsapp. Such manipulation of the argument mediaurl leads to server-side request forgery. The attack ma...

CVE-2017-7253

creationtimestamp| type| source ---|---|--- 2026-07-09 15:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7vx533e625...

CVE-2026-4256

creationtimestamp| type| source ---|---|--- 2026-07-09 14:52:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7v5f3nus2i...

CVE-2026-12593

creationtimestamp| type| source ---|---|--- 2026-07-09 14:47:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7uugogut2k...

CVE-2026-15173

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-15172

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-6352

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o...

CVE-2026-8472

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o 2026-07-10 17:44:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcp7nooid2k 2026-07-10 17:44:39+00:00| seen|...

CVE-2026-58305

creationtimestamp| type| source ---|---|--- 2026-07-09 12:42:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7ntwij7b2i...

CVE-2017-2847

creationtimestamp| type| source ---|---|--- 2026-07-09 12:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7nkvy5hh2s...

CVE-2017-2846

creationtimestamp| type| source ---|---|--- 2026-07-09 12:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7lvbi36e2o...

CVE-2026-7830

creationtimestamp| type| source ---|---|--- 2026-07-09 11:37:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq7kb3luk22s...

CVE-2026-5955

creationtimestamp| type| source ---|---|--- 2026-07-09 10:52:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq7hp5hsn72h...

CVE-2026-47831

creationtimestamp| type| source ---|---|--- 2026-07-09 08:46:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7aomhpfa2q 2026-07-09 17:36:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6cspnal2i...