Malicious code in qa-handoff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4939e56124668b7d03f9e2a96dfbfedba53e24aaa5d2190e298547e724b1f851 On npm install, the package automatically executes lib/setup.js via the postinstall lifecycle hook. The script spawns a detached Node process that...

MAL-2026-5571 Malicious code in qa-handoff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4939e56124668b7d03f9e2a96dfbfedba53e24aaa5d2190e298547e724b1f851 On npm install, the package automatically executes lib/setup.js via the postinstall lifecycle hook. The script spawns a detached Node process that...

Malicious code in jailbreak-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5 The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. src/c2.ts hardcodes a Discord webhook URL...

MAL-2026-5543 Malicious code in jailbreak-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5 The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. src/c2.ts hardcodes a Discord webhook URL...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper validation of the namespace field in the Package custom resource definition. An attacker can execute arbitrary commands during the build process and exfiltrate service...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the KubernetesWatchTrigger process. An attacker can gain unauthorized access to sensitive events from other namespaces by creating a KubernetesWatchTrigger in their own namespace, enabling persistent surveillan...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of namespace validation for the PackageRef.Namespace field. An attacker can access package data from other namespaces by submitting a crafted function specification...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of namespace validation for the PackageRef.Namespace field. An attacker can access package data from other namespaces by submitting a crafted function specification...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of namespace validation for the PackageRef.Namespace field. An attacker can access package data from other namespaces by submitting a crafted function specification...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of validation on the spec.environment.namespace field. An attacker can gain unauthorized access to environments in other namespaces by referencing them in a function...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of validation on the spec.environment.namespace field. An attacker can gain unauthorized access to environments in other namespaces by referencing them in a function...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of validation on the spec.environment.namespace field. An attacker can gain unauthorized access to environments in other namespaces by referencing them in a function...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the MergePodSpec process. An attacker can gain unauthorized access to cluster nodes and potentially take control of the entire cluster by injecting malicious fields into the podSpec configuration...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to improper validation of user-supplied pod specifications in the Environment process. An attacker can gain elevated privileges and potentially escape the node by specifying dangerous fields such as...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the podspec parameter in the Container Executor path. An attacker can gain elevated privileges and potentially escape the node by supplying a crafted podspec that is merged into the deployment process...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

MAL-2026-5529 Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

CVE-2026-50570

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety /...

CVE-2026-49824

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook pkg/webhook/function.go validated that spec.secrets.namespace and spec.configmaps.namespace...