Malicious code in thornqueue (PyPI)

Source: kam193 ea756029aedec54cd447267056236a9c4a6752d1a9973198ebf71c300fcd9112 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in sitecard (PyPI)

Source: kam193 49be8995374d0e3d2bcb8f163675221e14bfb6d7d968a6fa5d8165e4f493997d The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded location, exposing any user to be accessed by attacker. --...

Malicious code in runpier (PyPI)

Source: kam193 ab469bbd671fcc96fad392de06c7652a4f9ea899df3c86d285397bfc3985a690 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in marshrunner (PyPI)

Source: kam193 689d5b87d977bc368c98efb8cf42d53c25465575a667cd61337bb403dfdcb4fb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in loadferry (PyPI)

Source: kam193 6d5ed5a4ca84e5e36cc5a87ee1ef6652bb96f1dbe1ef3340a041060c6bb9f477 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ferretqueue (PyPI)

Source: kam193 00f1975c33600ed4869f6783ebd8d73e93e3a25f293b4f724ab2f4af2b1c9096 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in otterload (PyPI)

Source: kam193 6860fc5e0584389884eadd8bf39289d71d5c8c6dc01ca64603f3af344be8d755 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in taskquay (PyPI)

Source: kam193 692f4bcca72a6b53c989001619446e8b3b5bd66716674ca8230baa6d9d4c60a5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in reedworker (PyPI)

Source: kam193 f309ea93245f05b07163de9b85a0e47dcd64eeaec705794c502b21429eced883 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in flintqueue (PyPI)

Source: kam193 603240baf11c5a5c77d3a008dcfad49b31026bca034692ecae35780a6f0e6855 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in workslip (PyPI)

Source: kam193 6a509c00601b9f218feeb0cf12a7f84899efaf786edee659338d53d9888aa507 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in brookworker (PyPI)

Source: kam193 b5143967b27cd16bb4d28cbef2272599e90443b5f651a57e8f42d32c2e8b4ce2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in badgertask (PyPI)

Source: kam193 ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

Summary /api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so...

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different...

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-loca...

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Impact Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasksfilter emitted groups whose counts reflected denied notes, makemdquery returned ...result siblings, and listtemplates enumerated Templater template paths and parsed...

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

Summary On a Streamable HTTP deployment with auth.jwtSecret configured, serving a 2026-07-28-era client that declared elicitation.form support, a call to a dispatch-gated tool destructive: true, or a scope with an HITL floor that was offered an inputRequired confirmation could still complete afte...

obsidian-tc tokens can access arbitrary configured vaults

Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault ctx.vaultId; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault,...

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json,...

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...

@rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...

@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...

Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references. Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation...

Malicious code in onsokets (PyPI)

Source: kam193 844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons based on the campaign: -...

Malware in skillward

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in qowa (PyPI)

Source: kam193 67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd The package provides a C2 server and agent with pre-filed credentials, disguised as a generic utility. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-qowa...

Malware in @ecg-internal/adobe-dmp-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @grabcad/user-license

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ecg-internal/aurora-js-formatters

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ecg-internal/reviews-dialog-ui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @grabcad/preferences-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ecg-internal/favourites-ui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @grabcad/grabcad-shop-shared

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ecg-internal/media-util-js-lib

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @grabcad/company-server-shared

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @cecm-web-sdk/core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @blueskydataplatform/shared-ui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @kibt/www-nuxt-i18n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ecg-internal/js-react-i18n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @tekmidian/pai

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in journey-teste-shellhello (PyPI)

Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-journey-test-helloshell Reasons...

Malware in @factiii/runner

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references. Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read...

Malware in @seggy116/next-diff

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @pkgship/frps-linux-amd64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @pkgship/frpc-linux-amd64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in kvarzo8f3atestmetest

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in sdk-utils-testmetest

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...