CVE-2026-79760

The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated blind SSRF via the notification channel test endpoint. The root cause is a lack of destination allowlisting or private-address blocking in src/backend/database/routes/alert-rules-routes....

Malicious Package

Overview n8n-nodes-data-transformer-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @tvg-mar/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-alt-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview eslint-config-compact-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @test1230504/probe-7f3k2m-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

CVE-2026-79762: Use of Hard-coded Cryptographic Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

PT-2026-97920

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix derives keys used to wrap Data Encryption Keys DEK for OIDC and WebAuthn users from committed default strings and the public userId salt within the src/backend/utils/user-crypto.ts file...

MAL-2026-16467 Malicious code in @test1230504/probe-7f3k2m-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 941e9925e20dd460b4dc52c0981a140d58ed376e41b15457cbd6bcd5028ba0d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @test1230504/probe-7f3k2m-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @test1230504/probe-7f3k2m-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 941e9925e20dd460b4dc52c0981a140d58ed376e41b15457cbd6bcd5028ba0d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tvg-mar/utils (npm)

Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstructs Node core APIs 'os', 'dns', 'process', 'userInfo',...

Malicious code in eslint-config-compact-utils (npm)

Source: amazon-inspector 414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f On require, index.js collects host reconnaissance data os.hostname, os.userInfo.username, os.platform, architecture, Node version, current working directory together with CI/repository environment variables...

Malicious code in n8n-nodes-data-transformer-utils (npm)

Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocations to collect host information including reads of /etc/hos...

Malware in agora402-payment-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...