ROOT-OS-ALPINE-315-CVE-2026-22695 CVE-2026-22695 in libpng - Patched by Root

Root has patched CVE-2026-22695 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2025-65018 CVE-2025-65018 in libpng - Patched by Root

Root has patched CVE-2025-65018 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2026-22801 CVE-2026-22801 in libpng - Patched by Root

Root has patched CVE-2026-22801 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2026-25646 CVE-2026-25646 in libpng - Patched by Root

Root has patched CVE-2026-25646 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2025-66293 CVE-2025-66293 in libpng - Patched by Root

Root has patched CVE-2025-66293 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2026-33416 CVE-2026-33416 in libpng - Patched by Root

Root has patched CVE-2026-33416 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2026-33636 CVE-2026-33636 in libpng - Patched by Root

Root has patched CVE-2026-33636 in the libpng package for Root:Alpine:3.15. Multiple fixed versions available...

MAL-2026-17332 Malicious code in runhelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b30a78c30f51a72d8501b77d0cf6190319b8876ed7a119cc2f885adc3618212 On require'runhelper', index.js unconditionally loads a payload file staged by its dependency imgbundle at cdn-img-fetch/.runtime/rt.jpg, allocates...

ROOT-APP-GOBINARY-CVE-2026-84445 CVE-2026-84445 in google.golang.org/grpc - Patched by Root

Root has patched CVE-2026-84445 in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-84304 CVE-2026-84304 in google.golang.org/grpc - Patched by Root

Root has patched CVE-2026-84304 in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-33186 CVE-2026-33186 in google.golang.org/grpc - Patched by Root

Root has patched CVE-2026-33186 in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-HRXH-6V49-42GF GHSA-hrxh-6v49-42gf in google.golang.org/grpc - Patched by Root

Root has patched GHSA-hrxh-6v49-42gf in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available...

MAL-2026-17331 Malicious code in iban-validator-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fff3da0c4ead2e4f938efa16ad1cea92e872789a3b012edfed68526898cce4fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17328 Malicious code in fca-raihan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 241006adda5ea773d76d48d874c80a4054215ed18f05de3e392cdd86c0379785 package.json for fca-raihan declares a dependency whose key equals the package's own name fca-raihan with source github:raihan9099/fca-raihan. This i...

MAL-2026-17330 Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...

MAL-2026-17322 Malicious code in contoso-login-sim-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ce76699c91a883d24e3ad609bb04faa3f52cbeaecfb24c1c3bcde8b496a5c Package ships a single 138 KB browser script whose entire body is an RC4-encrypted base64 blob decoded at runtime by an inline RC4 routine zc with a...

MAL-2026-17320 Malicious code in cdn-img-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7922ab741ba357d3d9bb14201acdffd89639cb0b7a8850180d6dd9a8266e9f7 On require of cdn-img-fetch, index.js unconditionally invokes https.get against https://raw.githubusercontent.com/cavecrew/proj/main/banner.png and...

MAL-2026-17325 Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

MAL-2026-17323 Malicious code in cortana-md-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...

MAL-2026-17321 Malicious code in chaienv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb73465123d4e732dae815badc8950b40e9447463c1fca697551ab3aa00e020 [email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require time via const config ...

MAL-2026-17324 Malicious code in dotenv-preflight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0 The npm package [email protected] presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily...

ECHO-8B92-87D4-E89D

Bulletin has no description...

ECHO-16B5-4D27-985A

Bulletin has no description...

ECHO-D361-202F-EABD

Bulletin has no description...

ECHO-061E-D1EF-CD71

Bulletin has no description...

ECHO-8F5B-C193-24C0

Bulletin has no description...

MAL-2026-17316 Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...

MAL-2026-17318 Malicious code in developmentstelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ef8863222571a8e77635ed5129c41ad9583d9df4e9e5fd61b5a07c4fb26887 package.json declares scripts.postinstall = 'node index.js'. index.js is a 143-byte stub whose only behavior is to dynamically import the sole declar...

MAL-2026-17317 Malicious code in booking-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063 The package's package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The bundled 4444.vbs contains...

MAL-2026-17319 Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

MINI-8X7Q-Q3C6-HRGH

Bulletin has no description...

MINI-P6HR-8HJR-XJW8

Bulletin has no description...

ECHO-4F9B-35FC-3D3F

Bulletin has no description...

ECHO-8684-6944-09BB

Bulletin has no description...

MAL-2026-17314 Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

MAL-2026-17311 Malicious code in itsmeeaizat-bailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87b4292727088efa5df8326a5f868b2c6bb3ae66ee15cecc18f2fa899296075 package.json declares the libsignal dependency as git+https://github.com/whiskeysockets/libsignal-node with no tag, no commit SHA, and no integrity...

MAL-2026-17305 Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

MAL-2026-17309 Malicious code in stestenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jp...

MAL-2026-17310 Malicious code in tailwind-forms-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...

MAL-2026-17307 Malicious code in fabric-mod-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3ada8fa4c11f57f6f8bfcf158b33b56d71f6f1433910b981cec70492b2272a9 The package declares scripts.postinstall = 'node index.js'. On install, index.js performs an HTTPS GET to the hardcoded host fabric-npm.gm-service.xy...

MAL-2026-17304 Malicious code in dotenv-precheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e [email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, ...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

MAL-2026-17308 Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

MAL-2026-17302 Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

MAL-2026-17303 Malicious code in web-vitals-polyfill-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...

CLEANSTART-2026-ZN87081 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-DQ91908 On Linux, if the target of Root

Security vulnerability affects the minio-operator package. On Linux, if the target of Root...

CLEANSTART-2026-BD94423 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the minio-operator package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-MY04156 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the minio-operator package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-DP89465 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the minio-operator package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...