MAL-2026-4240 Malicious code in ethers-multicall-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe5e969b4ca41dbbd6ef1c04c12d48906ea4477b39493e766045effd4939d748 On npm install, the package's postinstall script spawns node -e to run an inline childprocess.execSync that curls a binary from...

oci-utils security update

-- 0.14.0-22 - Rework systemd service file creation. Orabug: 39316494...

Oracle Linux 8 : oci-utils (ELSA-2026-65763)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-65763 advisory. -- 0.14.0-22 - Rework systemd service file creation. Orabug: 39316494 Tenable has extracted the preceding description block directly from the Oracle Linux...

Malicious code in dabrius-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 381f128317bd76fe2e5d34df5decd7f27475bff72e646ccdb19cb1334a068b07 Package is local-only PoC of supply chain attack. The commented code and name reveals relation to the previously uploaded package containing data exfiltration...

MAL-2026-4176 Malicious code in dabrius-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 381f128317bd76fe2e5d34df5decd7f27475bff72e646ccdb19cb1334a068b07 Package is local-only PoC of supply chain attack. The commented code and name reveals relation to the previously uploaded package containing data exfiltration...

PT-2026-45671

Уязвимость функции cifs get spnego key инструмента cifs.upcall пакета cifs-utils ядра операционных систем Linux связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии до уровня root и выполнить произвольный код...

Malicious code in @antv/l7-utils (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4053 Malicious code in @antv/l7-utils (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@tmlmobilidade/utils has prototype pollution in its setValueAtPath

Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath. Patches A fix is available in versions 20260509.0340.15 and up...

GHSA-CMXG-94MG-JQ94 @tmlmobilidade/utils has prototype pollution in its setValueAtPath

Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath. Patches A fix is available in versions 20260509.0340.15 and up...

Malicious Package

Overview citrea-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-3831 Malicious code in citrea-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af3ffcf057e7fa952c80b46cbee31773e340ba668377511d7f3ee3b38c1c810 The package citrea-utils was found to contain malicious code. Source: ghsa-malware 0cbde9fcd3b6b009f9d8b0ff2dc739d877beb20223d14d402fcbc90515470eac A...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

0xble (>=14.0.0, <=23.2.2), 100xchat (>=1.1.5, <=1.3.5) +8030 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.53)

@ai-sdk/provider-utils NPM version =0.0.0, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.1.0-alpha.1, =0.1.0, =0.4.4, =0.4.15 and more Source cves: CVE-2026-8769 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16735288...

0xble (>=14.0.0, <=23.2.2), 100xchat (>=1.1.5, <=1.3.5) +8030 more potentially affected by CVE-2026-8768 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.53)

@ai-sdk/provider-utils NPM version =0.0.0, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.1.0-alpha.1, =0.1.0, =0.4.4, =0.4.15 and more Source cves: CVE-2026-8768 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16734888...

@ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0), @ai-sdk-tools/cache (>=0.11.0, <=0.13.0) +195 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (5.0.0-canary.48)

@ai-sdk/provider-utils NPM version 5.0.0-canary.48 is affected by a known vulnerability. The following packages have a transitive dependency on @ai-sdk/provider-utils and may be impacted: - @ai-sdk-tools/artifacts =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0, =5.0.0-beta.0, =3.0.0-beta.0,...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @activepieces/piece-activecampaign (>=0.1.4, <=0.1.5) +2087 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0, =0.2.0, =0.1.4, =0.0.1, =0.0.7, =0.0.1, =0.1.2 - @activepieces/piece-air-ops 0.1.5 - @activepieces/piece-aircall 0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1586 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0, =22.0.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.0.4, =0.0.1, =0.3.0, =0.0.1, =0.0.4, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...