Malware in @service-suppliers/fetch-initial-suppliers-watcher-saga

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @service-suppliers/fetch-suppliers-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview @service-suppliers/fetch-initial-suppliers-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between...

Malicious Package

Overview @service-suppliers/select-supplier-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malware in @service-suppliers/fetch-suppliers-watcher-saga

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @service-suppliers/select-supplier-watcher-saga

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-4436 Malicious code in @service-suppliers/select-supplier-watcher-saga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3829c1a8be4ed51ad5c9d714d223cb037f7d76df868b73e63c69c6c60ff8dbf3 On npm install, scripts/postinstall.js fetches a platform-specific script from https://oob.moika.tech/payload/linux|mac|win, writes it to the OS temp...

[SECURITY] Fedora 42 Update: awatcher-0.3.3-2.fc42

A window activity and idle watcher...

[SECURITY] Fedora 43 Update: awatcher-0.3.3-2.fc43

A window activity and idle watcher...

[SECURITY] Fedora 44 Update: awatcher-0.3.3-2.fc44

A window activity and idle watcher...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: kubescape, datadog-agent-fips, buildkite-agent, net-kourier, prometheus-operator, kube-arangodb, kine, aactl, zitadel, aws-flb-kinesis, nemo, flux-fips, cloud-provider-aws-fips, datadog-agent, gosu, argo-workflows, chezmoi, commercial-chainloop-cli, helm,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: kubescape, datadog-agent-fips, buildkite-agent, net-kourier, prometheus-operator, kube-arangodb, kine, aactl, zitadel, aws-flb-kinesis, nemo, flux-fips, cloud-provider-aws-fips, datadog-agent, gosu, argo-workflows, chezmoi, commercial-chainloop-cli, helm,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dgraph, local-path-provisioner, victoriametrics-cluster-fips, nemo, smokescreen, nova-fips, commercial-chainloop-cli, clickhouse-operator, nodetaint-fips, newrelic-k8s-metadata-injection, dataplaneapi-fips, cilium-certgen-fips, polaris-fips, envoy-ratelimit-fips,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: dgraph, local-path-provisioner, victoriametrics-cluster-fips, nemo, smokescreen, nova-fips, commercial-chainloop-cli, clickhouse-operator, nodetaint-fips, newrelic-k8s-metadata-injection, dataplaneapi-fips, cilium-certgen-fips, polaris-fips, envoy-ratelimit-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: dgraph, flux-fips, cloud-provider-aws-fips, gosu, newrelic-infrastructure-agent-fips, tkn, chezmoi, commercial-chainloop-cli, sonobuoy-fips, kubevirt-cdi-uploadserver-fips, gitlab-operator, helm-exporter, nsc, redpanda, vendir-fips, prometheus, commercial-expanso-edg...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: dgraph, flux-fips, cloud-provider-aws-fips, gosu, newrelic-infrastructure-agent-fips, tkn, chezmoi, commercial-chainloop-cli, sonobuoy-fips, kubevirt-cdi-uploadserver-fips, gitlab-operator, helm-exporter, nsc, redpanda, vendir-fips, prometheus, commercial-expanso-edg...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, dgraph, spiffe-helper, rekor-fips, docker-machine-driver-linode, milvus, victoriametrics-cluster-fips, flux-fips, cloud-provider-aws-fips, cloudnative-pg, gosu, longhorn-manager, newrelic-infrastructure-agent-fips, chezmoi, clickhouse-operator,...

CVE-2026-28674

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674 xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...