2120186 matches found
MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67731dfd8417d3a019f2004d38e10f4072a8acbaa183828f4e82f3b8a0de7ab7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17282 Malicious code in @hrmony/hyper-json-builder (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08fe204e5637fe696905f683edb7cba0c44df4ca14cbd809b3884f149d5dd90a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
ROOT-APP-NPM-GHSA-2X7J-588G-CCC2 GHSA-2x7j-588g-ccc2 in nodemailer - Patched by Root
Root has patched GHSA-2x7j-588g-ccc2 in the nodemailer package for Root:npm. Multiple fixed versions available...
DEBIAN-CVE-2026-66900
Bulletin has no description...
DEBIAN-CVE-2026-77913
Bulletin has no description...
DEBIAN-CVE-2026-66899
Bulletin has no description...
DEBIAN-CVE-2026-84788
Bulletin has no description...
DEBIAN-CVE-2026-17588
Bulletin has no description...
DEBIAN-CVE-2026-16271
Bulletin has no description...
ROOT-APP-NPM-GHSA-36JR-MH4H-2G58 GHSA-36jr-mh4h-2g58 in d3-color - Patched by Root
Root has patched GHSA-36jr-mh4h-2g58 in the d3-color package for Root:npm. Multiple fixed versions available...
MAL-2026-17264 Malicious code in @hrmony/kit-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a4084c44ab6554d66c474338de2cb482a25b31e6822d470e08b2b2ef5b1735a The package executes credential-harvesting code both from its postinstall script scripts/check-setup.mjs and from its main entry index.js, so theft...
MAL-2026-17263 Malicious code in @hrmony/kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role...
MAL-2026-17265 Malicious code in @hrmony/kit-4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...
MAL-2026-17266 Malicious code in @hrmony/kit-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...
MAL-2026-17253 Malicious code in @hrmony/benefit-essenszuschuss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...
MAL-2026-17249 Malicious code in @hrmony/account-management (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b699bc4a206505ba0cf224888996e37fe00dff5ffb737e3b95b9fd139b910f The main module executes on require/import via a top-level await. It queries the AWS IMDSv2 metadata service at 169.254.169.254 to retrieve instance...
MAL-2026-17251 Malicious code in @hrmony/app-gateway-templates (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d3f05113dd7daa9fac2da8187afecc751fafcf96449e7f4eb4a5d9a4878844 On require/import of @hrmony/app-gateway-templates, index.js the package main executes an exfiltration routine against a hardcoded attacker endpoint ...
MAL-2026-17262 Malicious code in @hrmony/interfaces (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7837cf2dff543cfea2f35e0dea5f767ca7b8e8f81129f4c770e5693ed247c0e index.js executes top-level async code on any require/import of the package. The code 1 obtains an AWS IMDSv2 token and fetches EC2 instance identity...
MAL-2026-17254 Malicious code in @hrmony/benefit-internetzuschuss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209d5855ea7b92261c91e4f405f0306f268bb92b9ca8f888bfec4d0a84053544 On module import, the package unconditionally beacons to the hardcoded external host...
MAL-2026-17258 Malicious code in @hrmony/cdk-constructs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...
MAL-2026-17255 Malicious code in @hrmony/benefit-mobilitaet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...
MAL-2026-17270 Malicious code in @hrmony/organisationsverwaltung (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78807365ee9728923ec2d5d103ce7f4562b21e2fc8185483b482bb5d2f79748d @hrmony/organisationsverwaltung 7.99.0 executes credential-theft code at the top level of index.js, so simply requiring or importing the package...
MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...
MAL-2026-17257 Malicious code in @hrmony/benefitverwaltung (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567d870fdf9c4fecac3e9fbb009a5b23e4450ea608d416564095680dc5bc4b2 On top-level import, the package's main module POSTs an initial identifying beacon body "c53":"hello" to the hardcoded endpoint...
MAL-2026-17271 Malicious code in @hrmony/pladddform-application (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6470f9f3652c9b3b65d783ca46babc5ccf24e0d8d044ca654260168e8f881e17 On module load, the package's main entry point executes three exfiltration routines that POST installer-side secrets to the hardcoded endpoint...
MAL-2026-17269 Malicious code in @hrmony/middlewares (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2129e9ecca729ffb0ac23ee07dd5be18f2a853560899599981bc92b19dda4363 On module load, the package queries the AWS instance metadata service at 169.254.169.254 IMDSv2 to enumerate instance identity, region, and network...
MAL-2026-17268 Malicious code in @hrmony/mailer-pladddform (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc17a6ae94f3beee4d60886e3233b210660bcd01f6c5f6d2fff840e6d385973b index.js executes at top-level import and performs three credential-harvesting flows directed at...
MAL-2026-17259 Malicious code in @hrmony/component-library (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93efe09ed89a9899669e54f614f80d91a80c59d77e0c2a2f673f92590488804 index.js declared as the package main runs top-level async code on require/import that performs three exfiltration actions against a hardcoded attack...
MAL-2026-17273 Malicious code in @hrmony/pladddform-codegen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4 On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint...
MAL-2026-17274 Malicious code in @hrmony/pladddform-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de81847796671c2a5e9f97a94fae50352b0dff0816e4f0a7dfaf707fbb92629 index.js executes at module top level on require/import. It performs an unconditional POST check-in to...
MAL-2026-17272 Malicious code in @hrmony/pladddform-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b9c27ba35a6978a0731d77b7d5fec367f4c2a8b4acc5838588071c89886fa4 On require/import, index.js performs three attacker-benefiting actions against a hardcoded endpoint at https://hrnmn.dd.h4x.tv/. First, it POSTs an...
MAL-2026-17279 Malicious code in @hrmony/pladddform-shared-infrastructure (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89319d39ad6d753459be90c221d657a73f70955c63d1675b347c11b5743209cc On module import, index.js executes three exfiltration routines that POST harvested secrets to the hardcoded endpoint...
MAL-2026-17278 Malicious code in @hrmony/pladddform-partner-registry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e09dd7e6a7777c82ec319c374c862db40d6bf7210991dac9a7a250fda4a259e7 On import, index.js executes a top-level fetch that harvests cloud and container secrets from the installer host and POSTs them to the hardcoded...
MAL-2026-17280 Malicious code in @hrmony/pladddform-testing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...
MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...
MAL-2026-17281 Malicious code in @hrmony/valuenet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...
MAL-2026-17277 Malicious code in @hrmony/pladddform-infrastructure (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...
MAL-2026-17252 Malicious code in @hrmony/belegerfassung-pladddform (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...
MAL-2026-17260 Malicious code in @hrmony/devtool-configuration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cb569df9c47639ee0fd16c34a4ac1b97b89733b1b468389d8032087ab233b On import, index.js performs an unconditional POST beacon to https://hrnmn.dd.h4x.tv/saveinstanceinfofrompkgehrmonydevtool-configuration, then querie...
MAL-2026-17267 Malicious code in @hrmony/lohndateien (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 743e2b2a4a3cf2758e6eb457dbc47857751d31379b13a48a2da25fc23f8e9701 index.js executes on module load and performs three attacker-beneficial actions against a hardcoded remote endpoint at...
MAL-2026-17276 Malicious code in @hrmony/pladddform-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...
MAL-2026-17275 Malicious code in @hrmony/pladddform-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605 On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 IMDSv2, retrieves the instance identity document,...
MAL-2026-17261 Malicious code in @hrmony/gutscheinverwaltung (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...
DEBIAN-CVE-2026-46675
Bulletin has no description...
CGA-M7MP-R9J3-P456
Bulletin has no description...
ROOT-OS-DEBIAN-12-CVE-2026-96889 CVE-2026-96889 in librsvg - Patched by Root
Root has patched CVE-2026-96889 in the librsvg package for Root:Debian:12. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-56852 CVE-2026-56852 in golang.org/x/text - Patched by Root
Root has patched CVE-2026-56852 in the golang.org/x/text package for Root:Go. Multiple fixed versions available...