MAL-2026-11485 Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

Malicious Package

Overview simple-date-formatter-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview simple-date-formatter-util-2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

GHSA-6H5J-32CF-4253 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Summary apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck causes this to bypass authorization on all piece-type REST API endpoint...

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

GHSA-JHR6-GM9C-RQJV sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

PT-2026-105526

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.existsmodel na...

MAL-2026-11233 Malicious code in @web3-util/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b6c5241d80dc8baa902550a561e37b238c483430f8c7b186abe033d11f8ea34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview json-to-table-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview syft-acp-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11095 Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

Malicious Package

Overview @array-util/subsearch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@acceleratxr/electron-shared (>=1.9.0, <=1.19.0), @adamklein/situp (>=1.0.4, <=1.0.5) +207 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=9.0.0, <=9.6.3)

builder-util-runtime NPM version =9.0.0, =1.9.0, =1.0.4, =26.0.11-2, =6.6.2-2, =0.1.0, =0.0.228, =0.0.1, =1.0.6, =0.0.1-beta.5, =0.0.3, =0.0.24, =0.0.50, =0.39.0, =1.17.0 and more Source cves: CVE-2026-54673 Source advisory: OSV:GHSA-P2F4-R6V6-J797...

NPM: electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

NPM: electron-updater: Cross-origin redirect leaks PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtime vulnerability discovered by ? in WordPress Npm builder-util-runtime versions 9.7.0...

GHSA-P2F4-R6V6-J797 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...

MAL-2026-11045 Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview org.eclipse.jetty:jetty-util is a Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions due to incorrect handling of ; path-parameter...