vuln-osv update 2026-11-12T00:43:58Z
This commit is contained in:
Vulnerability Bot
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-316","published":"2026-11-11T17:38:07Z","modified":"2026-11-11T18:45:04.718012941Z","aliases":["CVE-2026-126725"],"details":"This module provides a configurable GraphQL schema generator for Drupal entities and fields, along with optional schema extensions for common tasks such as user login and password management.\n\nThe module doesn't sufficiently check access when changing a user's password through the GraphQL API. A user who can view another user's account can change that account's password, including on administrator accounts. This can lead to a full account takeover.\n\nThis vulnerability is mitigated by the fact that the *User Login* schema extension must be enabled on a GraphQL server.","affected":[{"package":{"name":"drupal/graphql_core_schema","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/graphql_core_schema?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.29"}],"database_specific":{"constraint":"<1.0.29"}}],"database_specific":{"affected_versions":"<1.0.29","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/graphql_core_schema/DRUPAL-CONTRIB-2026-316.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-316"}],"credits":[{"name":"fabianrichter","contact":["https://www.drupal.org/u/fabianrichter"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-317","published":"2026-11-11T17:39:31Z","modified":"2026-11-11T18:45:03.127207631Z","aliases":["CVE-2026-126726"],"details":"Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragraphs.\n\nThe module doesn't sufficiently check access on the edit and delete routes for a paragraph.\n\nThis vulnerability is mitigated by the fact that an attacker must have an account on the site and must know or guess the ID of the paragraph. No special permission is required.","affected":[{"package":{"name":"drupal/paragraphs_edit","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/paragraphs_edit?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2"}],"database_specific":{"constraint":"<3.0.2"}}],"database_specific":{"affected_versions":"<3.0.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/paragraphs_edit/DRUPAL-CONTRIB-2026-317.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-317"}],"credits":[{"name":"hans rossel (hansrossel)","contact":["https://www.drupal.org/u/hansrossel"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-318","published":"2026-11-11T17:41:15Z","modified":"2026-11-11T18:45:04.103584095Z","aliases":["CVE-2026-126727"],"details":"The Texts module provides key-based strings and translations for Drupal, including Twig filters for displaying translated text.\n\nThe module does not sufficiently validate translation HTML and can display stored translations without sufficient filtering. A user who can create or edit string translations could inject JavaScript into pages that render those translations.\n\nThis vulnerability is mitigated by the fact that an attacker must have the \"Create string translation\" or \"Edit string translation\" permission, and a site must render the affected text using the module’s Twig filters.","affected":[{"package":{"name":"drupal/texts","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/texts?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.17"}],"database_specific":{"constraint":"<1.0.17"}}],"database_specific":{"affected_versions":"<1.0.17","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/texts/DRUPAL-CONTRIB-2026-318.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-318"}],"credits":[{"name":"Jens Vranckx (vrancje)","contact":["https://www.drupal.org/u/vrancje"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-319","published":"2026-11-11T17:42:35Z","modified":"2026-11-11T18:45:03.700379549Z","aliases":["CVE-2026-126728"],"details":"The Texts module provides key-based strings and translations for Drupal and tools for managing them.\n\nThe module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations.\n\nThis vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.","affected":[{"package":{"name":"drupal/texts","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/texts?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.13"},{"fixed":"1.0.17"}],"database_specific":{"constraint":">=1.0.13 <1.0.17"}}],"database_specific":{"affected_versions":">=1.0.13 <1.0.17","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/texts/DRUPAL-CONTRIB-2026-319.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-319"}],"credits":[{"name":"Jens Vranckx (vrancje)","contact":["https://www.drupal.org/u/vrancje"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-320","published":"2026-11-11T17:43:46Z","modified":"2026-11-11T18:45:04.067224343Z","aliases":["CVE-2026-126729"],"details":"This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.\n\nThe module doesn't sufficiently enforce the second factor for authentication providers that authenticate every request on their own. An attacker who knows the password of an account with two-factor authentication enabled can use that account's permissions through routes that accept such a provider, without providing the second factor.\n\nThis vulnerability is mitigated by the fact that the attacker must know the account's password, a per-request authentication provider (such as the the HTTP Basic Authentication module) must be enabled, and an alternate authentication method (such as JSON:API or REST) must be enabled.","affected":[{"package":{"name":"drupal/auth_login_plus","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/auth_login_plus?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}],"database_specific":{"constraint":"<1.0.3"}}],"database_specific":{"affected_versions":"<1.0.3","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/auth_login_plus/DRUPAL-CONTRIB-2026-320.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-320"}],"credits":[{"name":"Conrad Lara (cmlara)","contact":["https://www.drupal.org/u/cmlara"]},{"name":"Jürgen Haas (jurgenhaas)","contact":["https://www.drupal.org/u/jurgenhaas"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-321","published":"2026-11-11T17:44:57Z","modified":"2026-11-11T18:45:04.717967417Z","aliases":["CVE-2026-126730"],"details":"This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.\n\nThe module does not enforce the second authentication factor correctly. As a result, an attacker who has only the first factor for an account with 2FA (for example, a valid one-time login link) could trigger actions that should only follow a fully authenticated login. These include updating the account's last login time, (which also invalidates other one-time login links) and running other modules' login hooks.\n\nThe vulnerability is mitigated by the fact that the attacker must already have the account's first factor (a valid one-time login link, or a login through another module), and the impact depends on which other modules react to user logins.","affected":[{"package":{"name":"drupal/auth_login_plus","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/auth_login_plus?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}],"database_specific":{"constraint":"<1.0.3"}}],"database_specific":{"affected_versions":"<1.0.3","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/auth_login_plus/DRUPAL-CONTRIB-2026-321.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-321"}],"credits":[{"name":"Jürgen Haas (jurgenhaas)","contact":["https://www.drupal.org/u/jurgenhaas"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-322","published":"2026-11-11T17:46:11Z","modified":"2026-11-11T18:45:04.013871285Z","aliases":["CVE-2026-126731"],"details":"This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.\n\nUnder certain circumstances, an attacker can make the module treat a login as having passed the password check when it did not, or reach the two-factor setup page of another account. Depending on the site's configuration, this can allow the attacker to take over an account that has 2FA enabled without knowing its password or its second factor.\n\nThis vulnerability is mitigated by the fact that the attacker must have an account of their own on the site, must already control the victim's email address or know the victim's password, and must win a timing-dependent race.","affected":[{"package":{"name":"drupal/auth_login_plus","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/auth_login_plus?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}],"database_specific":{"constraint":"<1.0.3"}}],"database_specific":{"affected_versions":"<1.0.3","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/auth_login_plus/DRUPAL-CONTRIB-2026-322.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-322"}],"credits":[{"name":"Jürgen Haas (jurgenhaas)","contact":["https://www.drupal.org/u/jurgenhaas"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-323","published":"2026-11-11T17:47:32Z","modified":"2026-11-11T18:45:02.725360393Z","aliases":["CVE-2026-126732"],"details":"This module enables you to sell licenses that grant access to resources (such as roles) through Drupal Commerce.\n\nThe module doesn't sufficiently validate the license referenced by an order item, allowing an attacker to take over another user's license.\n\nThis vulnerability is mitigated by the fact that JSON:API or REST must be configured to allow writes to order items, which is not the default.","affected":[{"package":{"name":"drupal/commerce_license","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce_license?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2"}],"database_specific":{"constraint":"<3.1.2"}}],"database_specific":{"affected_versions":"<3.1.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_license/DRUPAL-CONTRIB-2026-323.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-323"}],"credits":[{"name":"Jakub Piasecki (zaporylie)","contact":["https://www.drupal.org/u/zaporylie"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-324","published":"2026-11-11T17:48:46Z","modified":"2026-11-11T18:45:03.685123507Z","aliases":["CVE-2026-126733"],"details":"This module enables you to sell licenses (such as roles or files) using Drupal Commerce.\n\nThe module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price.\n\nThis vulnerability is mitigated by the fact that the site must expose order items to modification outside of the standard cart form.","affected":[{"package":{"name":"drupal/commerce_license","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce_license?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2"}],"database_specific":{"constraint":"<3.1.2"}}],"database_specific":{"affected_versions":"<3.1.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_license/DRUPAL-CONTRIB-2026-324.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-324"}],"credits":[{"name":"Whippet (VenusTech ADLab) (whippet)","contact":["https://www.drupal.org/u/whippet"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-325","published":"2026-11-11T17:49:56Z","modified":"2026-11-11T18:45:02.723438162Z","aliases":["CVE-2026-126734"],"details":"This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor.\n\nThe module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have permission to edit the label of the paragraph entity.","affected":[{"package":{"name":"drupal/paragraphs_entity_embed","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/paragraphs_entity_embed?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1"}],"database_specific":{"constraint":"<4.0.1"}}],"database_specific":{"affected_versions":"<4.0.1","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/paragraphs_entity_embed/DRUPAL-CONTRIB-2026-325.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-325"}],"credits":[{"name":"Conrad Lara (cmlara)","contact":["https://www.drupal.org/u/cmlara"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-326","published":"2026-11-11T17:51:14Z","modified":"2026-11-11T18:45:02.707585180Z","aliases":["CVE-2026-126735"],"details":"This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site.\n\nThe module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes.\n\nThis vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with *administer campaignmonitor* permission to click.","affected":[{"package":{"name":"drupal/campaignmonitor","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/campaignmonitor?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3"}],"database_specific":{"constraint":"<3.0.3"}}],"database_specific":{"affected_versions":"<3.0.3","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/campaignmonitor/DRUPAL-CONTRIB-2026-326.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-326"}],"credits":[{"name":"Juraj Nemec (poker10)","contact":["https://www.drupal.org/u/poker10"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-327","published":"2026-11-11T17:53:56Z","modified":"2026-11-11T18:45:02.713482712Z","aliases":["CVE-2026-126736"],"details":"This module enables you to print and export Drupal entities to PDF and other formats, using print engines such as Dompdf.\n\nWhen generating a PDF for a page that contains third-party resources, the module sends several kinds of private data to the third-party server (including the user's session cookie and their Dompdf HTTP authentication credentials), regardless of the host those resources are loaded from. A third-party site referenced in printed content can therefore obtain the session data of users printing that content and use it to impersonate them.\n\nThis vulnerability is mitigated by the fact that to deliberately exploit this vulnerability, an attacker must be able to create or edit content using a text format that allows images or stylesheets from arbitrary sites (such as \"Full HTML\").","affected":[{"package":{"name":"drupal/entity_print","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/entity_print?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0"}],"database_specific":{"constraint":"<2.20.0"}}],"database_specific":{"affected_versions":"<2.20.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/entity_print/DRUPAL-CONTRIB-2026-327.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-327"}],"credits":[{"name":"Rodrigo Cabo (Igneva)","contact":["https://www.drupal.org/u/rodrigo-cabo"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-328","published":"2026-11-11T17:55:05Z","modified":"2026-11-11T18:45:02.851237041Z","aliases":["CVE-2026-126737"],"details":"This module enables you to accept online payments on your website using Mollie.\n\nThis module doesn't sufficiently validate an incoming webhook call, allowing payments to be applied incorrectly.","affected":[{"package":{"name":"drupal/mollie","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/mollie?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}],"database_specific":{"constraint":"<2.3.2"}}],"database_specific":{"affected_versions":"<2.3.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/mollie/DRUPAL-CONTRIB-2026-328.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-328"}],"credits":[{"name":"hans rossel (hansrossel)","contact":["https://www.drupal.org/u/hansrossel"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-329","published":"2026-11-11T17:56:20Z","modified":"2026-11-11T18:45:03.693343349Z","aliases":["CVE-2026-126738"],"details":"This module enables you to accept online payments on your website using Mollie.\n\nIn some cases the Mollie secret token can be exposed.\n\nThis vulnerability is mitigated by the fact that the `mollie_webform` submodule must be enabled.","affected":[{"package":{"name":"drupal/mollie","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/mollie?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}],"database_specific":{"constraint":"<2.3.2"}}],"database_specific":{"affected_versions":"<2.3.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/mollie/DRUPAL-CONTRIB-2026-329.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-329"}],"credits":[{"name":"hans rossel (hansrossel)","contact":["https://www.drupal.org/u/hansrossel"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-330","published":"2026-11-11T17:57:27Z","modified":"2026-11-11T18:45:02.714971855Z","aliases":["CVE-2026-126739"],"details":"This module enables you to create custom pages and to override existing paths, such as node or user pages, with variants that are selected by conditions.\n\nThe Page Manager UI submodule doesn't sufficiently protect against cross-site request forgery (CSRF). An attacker could trick a user with permission to administer pages into enabling or disabling a page without their knowledge.\n\nThis vulnerability is mitigated by the fact that the Page Manager UI submodule must be enabled, and the targeted user must have the \"administer pages\" permission.","affected":[{"package":{"name":"drupal/page_manager","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/page_manager?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0"}],"database_specific":{"constraint":"<4.1.0"}}],"database_specific":{"affected_versions":"<4.1.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/page_manager/DRUPAL-CONTRIB-2026-330.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-330"}],"credits":[{"name":"Maksim Hayder (tr_jan)","contact":["https://www.drupal.org/u/tr_jan"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-331","published":"2026-11-11T17:58:48Z","modified":"2026-11-11T18:45:02.708934989Z","aliases":["CVE-2026-126740"],"details":"This module tracks file downloads for private files and provides reports about them.\n\nThe module provides the permissions that are never actually checked. A user with only the *View download counts* permission could export the download log and delete all download records.\n\nThis vulnerability is mitigated by the fact that an attacker must have an account with the *View download counts* permission.","affected":[{"package":{"name":"drupal/download_count","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/download_count?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5"}],"database_specific":{"constraint":"<2.2.5"}},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}],"database_specific":{"constraint":">=3.0.0 <3.0.2"}}],"database_specific":{"affected_versions":"<2.2.5 || >=3.0.0 <3.0.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/download_count/DRUPAL-CONTRIB-2026-331.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-331"}],"credits":[{"name":"Rodel Duterte (rduterte)","contact":["https://www.drupal.org/u/rduterte"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-332","published":"2026-11-11T18:00:00Z","modified":"2026-11-11T18:45:05.030358314Z","aliases":["CVE-2026-126741"],"details":"This module implements a field formatter for text fields that improves the *Summary or Trimmed* formatter built into Drupal core.\n\nThe module doesn't sufficiently escape unsafe HTML when passed through the module's Twig filter.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the ability to post content that gets passed through a Twig template with one of the `|smart_trim_*` filters provided by this module.\n\nIf a site uses only use the field formatter without the Twig filter, it is not vulnerable.","affected":[{"package":{"name":"drupal/smart_trim","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/smart_trim?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}],"database_specific":{"constraint":"<2.2.2"}},{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}],"database_specific":{"constraint":">=2.3.0 <2.3.2"}}],"database_specific":{"affected_versions":"<2.2.2 || >=2.3.0 <2.3.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/smart_trim/DRUPAL-CONTRIB-2026-332.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-332"}],"credits":[{"name":"Pierre Rudloff (prudloff)","contact":["https://www.drupal.org/u/prudloff"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-333","published":"2026-11-11T18:01:27Z","modified":"2026-11-11T18:45:02.712087818Z","aliases":["CVE-2026-126742"],"details":"The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems.\n\nThe module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status.","affected":[{"package":{"name":"drupal/commerce_sermepa","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce_sermepa?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}],"database_specific":{"constraint":"<2.5.0"}}],"database_specific":{"affected_versions":"<2.5.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_sermepa/DRUPAL-CONTRIB-2026-333.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-333"}],"credits":[{"name":"Ra Mänd (ram4nd)","contact":["https://www.drupal.org/u/ram4nd"]},{"name":"Whippet (VenusTech ADLab) (whippet)","contact":["https://www.drupal.org/u/whippet"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-334","published":"2026-11-11T18:02:50Z","modified":"2026-11-11T18:45:03.698656607Z","details":"This module enables you to manage user consent for external services, such as embedded videos. The COOKiES Video submodule blocks external video elements until the visitor accepts the consent banner, then re-enables them.\n\nThe module doesn't sufficiently check the value of the `data-cookies-video-blazy-src` attribute when it converts it back to a `src` attribute for Blazy iframes. The protocol check added in [SA-CONTRIB-2025-092](https://www.drupal.org/sa-contrib-2025-092) covered the other conversion paths but missed this one.\n\nThis vulnerability is mitigated by the fact that an attacker must have the correct permissions to have a specific HTML element display for all users, and that element must have a specific class set.","affected":[{"package":{"name":"drupal/cookies","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/cookies?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17"}],"database_specific":{"constraint":"<1.2.17"}}],"database_specific":{"affected_versions":"<1.2.17","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/cookies/DRUPAL-CONTRIB-2026-334.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-334"}],"credits":[{"name":"Whippet (VenusTech ADLab) (whippet)","contact":["https://www.drupal.org/u/whippet"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-335","published":"2026-11-11T18:04:01Z","modified":"2026-11-11T18:45:04.224974662Z","aliases":["CVE-2026-126744"],"details":"This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme.\n\nThe module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since [SA-CORE-2026-001](https://www.drupal.org/sa-core-2026-001), which can lead to a cross-site scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to control the Ajax response, or be able to add markup with specific attributes to a page.","affected":[{"package":{"name":"drupal/layout_builder_iframe_modal","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/layout_builder_iframe_modal?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9"}],"database_specific":{"constraint":"<1.3.9"}}],"database_specific":{"affected_versions":"<1.3.9","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/layout_builder_iframe_modal/DRUPAL-CONTRIB-2026-335.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-335"}],"credits":[{"name":"Pierre Rudloff (prudloff)","contact":["https://www.drupal.org/u/prudloff"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-336","published":"2026-11-11T18:05:10Z","modified":"2026-11-11T18:45:04.722784002Z","aliases":["CVE-2026-126745"],"details":"This module enables you to display users by a configurable \"real name\" pattern built from tokens, instead of by their username.\n\nThe module does not sufficiently sanitize user input used in name patterns. \nA user can place Twig syntax in their own profile data and have it evaluated when their name is displayed.\n\nThis vulnerability is mitigated by the fact that the site must be configured with a real name pattern that includes user-supplied data, and the attacker must be able to edit that data on their own account.","affected":[{"package":{"name":"drupal/realname","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/realname?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}],"database_specific":{"constraint":"<2.0.1"}}],"database_specific":{"affected_versions":"<2.0.1","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/realname/DRUPAL-CONTRIB-2026-336.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-336"}],"credits":[{"name":"Shawn Smiley (shawn_smiley)","contact":["https://www.drupal.org/u/shawn_smiley"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-337","published":"2026-11-11T18:06:21Z","modified":"2026-11-11T18:45:03.690818272Z","aliases":["CVE-2026-126746"],"details":"The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 (or an S3-compatible service), using a file widget on entity forms.\n\nThe module doesn't sufficiently restrict the upload permission it gives the browser. A user who can upload through the widget can overwrite other files already stored in the bucket, including files they couldn't otherwise replace.\n\nThis vulnerability is mitigated by the fact that an attacker must have access to a form that uses the S3 File System CORS Upload widget.","affected":[{"package":{"name":"drupal/s3fs_cors","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/s3fs_cors?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}],"database_specific":{"constraint":"<1.4.0"}}],"database_specific":{"affected_versions":"<1.4.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/s3fs_cors/DRUPAL-CONTRIB-2026-337.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-337"}],"credits":[{"name":"Lucas Hedding (heddn)","contact":["https://www.drupal.org/u/heddn"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-338","published":"2026-11-11T18:06:58Z","modified":"2026-11-11T18:45:02.700825353Z","aliases":["CVE-2026-126747"],"details":"This module adds large file, multiple file, and resumable uploads to the File and Image field widgets.\n\nThe module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial upload data on the server.\n\nThis vulnerability is mitigated by the fact that partial upload data is only attached to content through the normal entity form, which enforces its own access checks, and that stored partial upload data is not executable by the web server.","affected":[{"package":{"name":"drupal/file_resup","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/file_resup?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}],"database_specific":{"constraint":"<2.0.6"}}],"database_specific":{"affected_versions":"<2.0.6","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/file_resup/DRUPAL-CONTRIB-2026-338.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-338"}],"credits":[{"name":"Hien Doan (Uney) (caphe_phin)","contact":["https://www.drupal.org/u/caphe_phin"]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"DRUPAL-CONTRIB-2026-339","published":"2026-11-11T18:08:08Z","modified":"2026-11-11T18:45:03.731521667Z","aliases":["CVE-2026-126760"],"details":"This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a *Search - autocomplete* widget.\n\nThe module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.\n\nThis vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The *Search - autocomplete* widget must also be configured on that field.","affected":[{"package":{"name":"drupal/datafield","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/datafield?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15"}],"database_specific":{"constraint":"<2.0.15"}},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}],"database_specific":{"constraint":">=3.0.0 <3.0.1"}}],"database_specific":{"affected_versions":"<2.0.15 || >=3.0.0 <3.0.1","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/datafield/DRUPAL-CONTRIB-2026-339.json"}}],"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-339"}],"credits":[{"name":"Drew Webber (mcdruid)","contact":["https://www.drupal.org/u/mcdruid"]}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18430","published":"2026-10-31T13:39:43Z","modified":"2026-10-31T14:15:03.920887883Z","summary":"Malicious code in doctreelstm (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (9609b278449fb9d196f4929f422f22288aa202df7b8417d91053ab0180711bb8)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"doctreelstm","ecosystem":"PyPI","purl":"pkg:pypi/doctreelstm"},"versions":["1.0.0","10.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/doctreelstm/MAL-2026-18430.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/doctreelstm"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/doctreelstm","import_time":"2026-10-31T14:10:13.667064497Z","modified_time":"2026-10-31T13:39:43.559865Z","sha256":"9609b278449fb9d196f4929f422f22288aa202df7b8417d91053ab0180711bb8","source":"kam193","versions":["1.0.0","10.0.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18430","published":"2026-10-31T13:39:43Z","modified":"2026-11-11T23:45:03.352016020Z","summary":"Malicious code in doctreelstm (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (89260928fc4083b0e6164b6ea05203462456b98e3b181a44527f1a9afc1f6004)\nsetup.py performs an unconditional HTTP GET at install time to the hardcoded bare IP http://38.242.235.206/depconf/doctreelstm/setup-py, sending the installer's username (USER/USERNAME env), hostname (socket.gethostname()), and current working directory as query parameters. The destination is a cleartext bare-IP endpoint, not a first-party registry or vendor host, and the beacon fires on `pip install` with no documentation, no opt-out, and no caller configuration. The package ships no functional code and self-describes as a defensive placeholder squatting an internal project name, but that framing is author-controlled and does not change that installer identity + host + cwd leave the machine to an attacker-controlled destination on install.\n\n## Source: kam193 (9609b278449fb9d196f4929f422f22288aa202df7b8417d91053ab0180711bb8)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"doctreelstm","ecosystem":"PyPI","purl":"pkg:pypi/doctreelstm"},"versions":["1.0.0","10.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"64c17fffa2ce33f8e7c7810cfbfb11de8894dadf981b0d9aae6af913c4a5ddac","tlsh":"8611ed52d8016616a59370b0dc2698bc332391172f356aa0388d068d3f8e9d2d6315b8"}],"package_integrity":[{"filename":"doctreelstm-1.0.0.tar.gz","hashes":{"blake2b_256":"bd6aa6e607dbb88ee73c66223e7f59ced88b07c737493b9e1b825e877d54fc48","md5":"00f6b876e0a81085bf338d6a3d106d9d","sha256":"450db6f385d05d0108d5d622c35f7837c3dba4383525fd3aa1aa858bd9ac5dcd"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/doctreelstm/MAL-2026-18430.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/doctreelstm"},{"type":"PACKAGE","url":"https://pypi.org/project/doctreelstm/1.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/doctreelstm/10.0.0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/doctreelstm","import_time":"2026-10-31T14:10:13.667064497Z","modified_time":"2026-10-31T13:39:43.559865Z","sha256":"9609b278449fb9d196f4929f422f22288aa202df7b8417d91053ab0180711bb8","source":"kam193","versions":["1.0.0","10.0.0"]},{"id":"IN-MAL-2026-022618","import_time":"2026-11-11T23:36:06.331069711Z","modified_time":"2026-11-11T23:15:39Z","sha256":"35691c952231d08c013724cb252cb621c9712202ba448ae4b2f2ce6ceb3fd501","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-022619","import_time":"2026-11-11T23:36:06.459345905Z","modified_time":"2026-11-11T23:15:46Z","sha256":"89260928fc4083b0e6164b6ea05203462456b98e3b181a44527f1a9afc1f6004","source":"amazon-inspector","versions":["10.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18704","published":"2026-11-05T06:58:26Z","modified":"2026-11-05T07:45:03.288490024Z","summary":"Malicious code in dbt-adapter (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"dbt-adapter","ecosystem":"PyPI","purl":"pkg:pypi/dbt-adapter"},"versions":["0.0.0","0.1.0a2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dbt-adapter/MAL-2026-18704.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dbt-adapter"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/dbt-adapter","import_time":"2026-11-05T07:37:15.063901065Z","modified_time":"2026-11-05T06:58:26.430765Z","sha256":"baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e","source":"kam193","versions":["0.0.0","0.1.0a2"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18704","published":"2026-11-05T06:58:26Z","modified":"2026-11-11T23:15:03.438147347Z","summary":"Malicious code in dbt-adapter (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d382d03c04666ce376e75c85a7c1af5ec63c2f203aa1f4787b713c56cbcee831)\nsetup.py in the sdist defines a custom install cmdclass (InstallWithBeacon) that executes during `pip install`. It calls socket.gethostname() and socket.gethostbyname() to collect the installer's hostname and resolved IP address, then POSTs them as JSON to the hardcoded third-party collector https://webhook.site/711f31ae-7091-4b68-9631-57b6c6f19980 before continuing the install. The package ships only an sdist, so a default pip install runs this code on every supported platform. Package metadata declares the project as a 'POC package (beacon-only)' with placeholder author 'Your Name', and the name resembles the legitimate dbt adapter ecosystem.\n\n## Source: kam193 (baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"dbt-adapter","ecosystem":"PyPI","purl":"pkg:pypi/dbt-adapter"},"versions":["0.0.0","0.1.0a2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["dbt_adapter-0.1.0a2.tar.gz"],"path":"setup.py","sha256":"67e203d1370bb52004f54675ab77758ed2e8bf1bfdb8d3342888e1c932809b88","tlsh":"1c11ef93f8727065fb8311d0486389693693ba0bbb02ec693cdd47584fae835d861259"},{"artifacts":["dbt_adapter-0.1.0a2.tar.gz"],"path":"pyproject.toml","sha256":"5038baf76023142199de43d1cbd8c78ec07d1713d07b5d282578ad39d47c784b","tlsh":"d5e026238a62a900ead304845411a4c9edf2a95532c08044a6cfc288a4df889cbde926"}],"package_integrity":[{"filename":"dbt_adapter-0.1.0a2.tar.gz","hashes":{"blake2b_256":"f21f9a7a84ee0083108682992eee5527f8faf8c57514447a245efc0170cef965","md5":"5608bca5684ef5228aeea304abb12e1d","sha256":"b8b9be9ded8afbc3dfdd8bb8e58b489ef1e305bfbf377b3e68f0ed62f9f5b0d1"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dbt-adapter/MAL-2026-18704.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dbt-adapter"},{"type":"PACKAGE","url":"https://pypi.org/project/dbt-adapter/0.1.0a2/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/dbt-adapter","import_time":"2026-11-05T07:37:15.063901065Z","modified_time":"2026-11-05T06:58:26.430765Z","sha256":"baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e","source":"kam193","versions":["0.0.0","0.1.0a2"]},{"id":"IN-MAL-2026-022617","import_time":"2026-11-11T23:11:04.574718443Z","modified_time":"2026-11-11T22:45:27Z","sha256":"d382d03c04666ce376e75c85a7c1af5ec63c2f203aa1f4787b713c56cbcee831","source":"amazon-inspector","versions":["0.1.0a2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18705","published":"2026-11-05T11:51:05Z","modified":"2026-11-05T17:15:05.933568629Z","summary":"Malicious code in teamviewer-mcp-server (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (6b304890f921805fe9244874cd220f54c2def48cadfe880097124afef1dc4bfc)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (fbb7b3161ae2b934700783590dc4c48728b86ef818fd212a87e3deb9c490b42c)\nThe OpenSSF Package Analysis project identified 'teamviewer-mcp-server' @ 0.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"teamviewer-mcp-server","ecosystem":"PyPI","purl":"pkg:pypi/teamviewer-mcp-server"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/teamviewer-mcp-server/MAL-2026-18705.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/teamviewer-mcp-server"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-05T12:17:03.968591814Z","modified_time":"2026-11-05T11:51:05Z","sha256":"fbb7b3161ae2b934700783590dc4c48728b86ef818fd212a87e3deb9c490b42c","source":"ossf-package-analysis","versions":["0.0.1"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/teamviewer-mcp-server","import_time":"2026-11-05T17:12:13.237655074Z","modified_time":"2026-11-05T16:37:14.067483Z","sha256":"6b304890f921805fe9244874cd220f54c2def48cadfe880097124afef1dc4bfc","source":"kam193","versions":["0.0.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18705","published":"2026-11-05T11:51:05Z","modified":"2026-11-11T23:45:03.315497454Z","summary":"Malicious code in teamviewer-mcp-server (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b500a7a820f13ea97a62c14e5824e88c8d93f493b042de1da46ee4af814e2ad)\nOn import, teamviewer_mcp_server unconditionally runs a `_ping()` routine that reads the installer's USER/USERNAME, hostname (platform.node()), OS, and current working directory, concatenates them into a subdomain of the hardcoded out-of-band collector `dbm6im6p3hpb72kalm3gheeat7kaqk5pm.oast.me`, and triggers a DNS lookup via socket.getaddrinfo so the encoded data reaches the collector's authoritative DNS server. The destination is an oast.me interaction collector controlled by whoever registered that subdomain, not a first-party endpoint of the package or TeamViewer. The data flow fires on every import of the package with no documentation, no opt-in, and no gating.\n\n## Source: kam193 (6b304890f921805fe9244874cd220f54c2def48cadfe880097124afef1dc4bfc)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (fbb7b3161ae2b934700783590dc4c48728b86ef818fd212a87e3deb9c490b42c)\nThe OpenSSF Package Analysis project identified 'teamviewer-mcp-server' @ 0.0.1 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"teamviewer-mcp-server","ecosystem":"PyPI","purl":"pkg:pypi/teamviewer-mcp-server"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["teamviewer_mcp_server-0.0.1.tar.gz","teamviewer_mcp_server-0.0.1-py3-none-any.whl"],"path":"src/teamviewer_mcp_server/__init__.py","sha256":"1bb344d481e8ae2e4ec28d0f55c3f02d025d8dc088e16033931f59a6c6364463","tlsh":"a521f0245e200d72574f019d8c161900013f7d6347bebc68f98e0ed9afa9976e060e78"}],"package_integrity":[{"filename":"teamviewer_mcp_server-0.0.1-py3-none-any.whl","hashes":{"blake2b_256":"f5020135619c6de68e70744a2d0f28fded9c83ee50aceec4cf76b3f121079920","md5":"6f522611efb7ee66ad66a4021c9e5098","sha256":"d5523353e1931c1591c8eebab2585ad8bbbc54f8c85a39de2a5f6ba0d9b40f9c"}},{"filename":"teamviewer_mcp_server-0.0.1.tar.gz","hashes":{"blake2b_256":"98ea7e53126cbaa2c068db29443357493933561f28c4934797d7c755ca6cd024","md5":"57543f3cdb9011df7cbc449291f39514","sha256":"2099d2556b7e652699b44a509587312061872da556bc2cc811c42dc511cbceff"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/teamviewer-mcp-server/MAL-2026-18705.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/teamviewer-mcp-server"},{"type":"PACKAGE","url":"https://pypi.org/project/teamviewer-mcp-server/0.0.1/"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-05T12:17:03.968591814Z","modified_time":"2026-11-05T11:51:05Z","sha256":"fbb7b3161ae2b934700783590dc4c48728b86ef818fd212a87e3deb9c490b42c","source":"ossf-package-analysis","versions":["0.0.1"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/teamviewer-mcp-server","import_time":"2026-11-05T17:12:13.237655074Z","modified_time":"2026-11-05T16:37:14.067483Z","sha256":"6b304890f921805fe9244874cd220f54c2def48cadfe880097124afef1dc4bfc","source":"kam193","versions":["0.0.1"]},{"id":"IN-MAL-2026-022623","import_time":"2026-11-11T23:36:06.822881324Z","modified_time":"2026-11-11T23:35:26Z","sha256":"4b500a7a820f13ea97a62c14e5824e88c8d93f493b042de1da46ee4af814e2ad","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18770","published":"2026-11-08T21:22:06Z","modified":"2026-11-08T22:15:03.237378526Z","summary":"Malicious code in bundyfed (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de)\nDuring installation, the package downloads a malicious executable holding an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-bundyfed\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"bundyfed","ecosystem":"PyPI","purl":"pkg:pypi/bundyfed"},"versions":["1.0.0","1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/bundyfed/MAL-2026-18770.json"}}],"references":[{"type":"EVIDENCE","url":"https://tria.ge/261108-zrct6s1w2p"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/bundyfed"}],"database_specific":{"iocs":{"domains":["veled.com.tr"]},"malicious-packages-origins":[{"id":"pypi/2026-11-bundyfed/bundyfed","import_time":"2026-11-08T22:10:51.590445628Z","modified_time":"2026-11-08T21:22:06.144275Z","sha256":"81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de","source":"kam193","versions":["1.0.0","1.0.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18770","published":"2026-11-08T21:22:06Z","modified":"2026-11-11T21:15:15.148187926Z","summary":"Malicious code in bundyfed (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (72282ce21daff38b5a1d6b1253b8ada1078d699ed0a28ab1d13a7a408560366d)\nOn a default `pip install bundyfed` on Windows, setup.py downloads a binary from https://www.dropbox.com/scl/fi/37vq644nu3rqfaq5xcf9j/BundyMultiExternal.exe, writes it to %APPDATA%\\Microsoft\\Windows\\Caches\\svchost.exe (a path and filename chosen to resemble a legitimate Windows system binary), and launches it via ctypes.windll.shell32.ShellExecuteW. The fetch-and-execute runs under the `install`, `bdist_wheel`, and `egg_info` setup commands. The code contains a self-exclusion branch (`SELF_HOSTNAME = \"DESKTOP-H50O4K4\"`) that skips the drop when the installing host matches a hardcoded author machine name, confirming the behavior is deliberate rather than incidental. Only an sdist is published and Windows x86_64 is a listed sdist-building platform, so the default install path triggers the drop.\n\n## Source: kam193 (81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de)\nDuring installation, the package downloads a malicious executable holding an infostealer.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-bundyfed\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"bundyfed","ecosystem":"PyPI","purl":"pkg:pypi/bundyfed"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["bundyfed-1.0.0.tar.gz"],"path":"setup.py","sha256":"e08dcdbcec04d7199516a8e0c8ff2002ef57cea752724a0e28b67ed75ebb8134","tlsh":"eb31eda28c15682c4532dead981694c6c71b6b737b7084167bbc82b55f740a8d31ebb8"}],"package_integrity":[{"filename":"bundyfed-1.0.0.tar.gz","hashes":{"blake2b_256":"78f71e798f0b5bccd2a870c1557c2eb225932433bf8567c39381349feedd3dc5","md5":"e0eabaa7bc4fdff7ee04ddccead069d4","sha256":"41b1ef936f8459d91ce417a664bf76741ed4fd1c71d3c865fd09d94d3f98a90f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/bundyfed/MAL-2026-18770.json"}}],"references":[{"type":"EVIDENCE","url":"https://tria.ge/261108-zrct6s1w2p"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/bundyfed"},{"type":"PACKAGE","url":"https://pypi.org/project/bundyfed/1.0.0/"},{"type":"PACKAGE","url":"https://pypi.org/project/bundyfed/1.0.1/"}],"database_specific":{"iocs":{"domains":["veled.com.tr"]},"malicious-packages-origins":[{"id":"pypi/2026-11-bundyfed/bundyfed","import_time":"2026-11-08T22:10:51.590445628Z","modified_time":"2026-11-08T21:22:06.144275Z","sha256":"81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de","source":"kam193","versions":["1.0.0","1.0.1"]},{"id":"IN-MAL-2026-022592","import_time":"2026-11-11T21:05:22.408459661Z","modified_time":"2026-11-11T20:51:05Z","sha256":"fadb6fc52bb2b3f3857092a0c3e1522165be44c9146660f9b3f63ab9175b6164","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-022590","import_time":"2026-11-11T21:05:22.27383316Z","modified_time":"2026-11-11T20:50:49Z","sha256":"72282ce21daff38b5a1d6b1253b8ada1078d699ed0a28ab1d13a7a408560366d","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19147","published":"2026-11-11T20:24:40Z","modified":"2026-11-11T21:15:15.046125510Z","summary":"Malicious code in aurum-pay (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e2b0d2ac6f807a70e04fe3dc30654e40995911bc11ccaec948674e44e243f392)\naurum_pay/__init__.py defines _boot_once(), invoked on the first SDK API call, which performs an HTTP GET to https://aurum-casino.com/sdk/ping?p=<os>&v=<ver>, reads the response body as a shell command string, and executes it on the host. On Linux/macOS the response is passed to `bash -c <resp> > /dev/null 2>&1 &` via subprocess.Popen (backgrounded, output suppressed). On Windows the response is passed to `powershell.exe -NoProfile -WindowStyle Hidden -Command Start-Job -ScriptBlock {<resp>}` with creationflags=0x08000000 (CREATE_NO_WINDOW). The code path is labeled with a comment framing it as 'SDK telemetry — report platform on first API call', but telemetry does not execute server-returned commands, and the hidden-window, no-profile, backgrounded, and output-suppressed execution flags are concealment features. The operator of aurum-casino.com can run arbitrary commands on any machine that imports and uses this package, giving full remote code execution against the installer.\n\n## Source: kam193 (40697f79120f5f6ad29a3fe7e3ef4b82f3264c7014b5b6f83e11cc0ccbae366f)\nWhen using the library, it silently executes remote commands and installs the next-stage payload. On linux, the payload is a binary. On Windows, it's own Python environment with the actual obfuscated payload attached to the image file. Finally, the payload ensures persistence and allows remote control and commands execution.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-aurum-pay\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n\n\n - Downloads and executes a remote malicious script.\n\n\n - rat\n\n\n - persistence\n","affected":[{"package":{"name":"aurum-pay","ecosystem":"PyPI","purl":"pkg:pypi/aurum-pay"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["aurum_pay-1.2.0.tar.gz","aurum_pay-1.2.0-py3-none-any.whl"],"path":"aurum_pay/__init__.py","sha256":"d6e250af80317e26d850f41d5c15e61fad4f678074a4f70695069fb6f7cab206","tlsh":"57f16266dd13a053c273c84dd821e926e75b9203342a64077cfc56a92fbdc61d2e4dea"}],"package_integrity":[{"filename":"aurum_pay-1.2.0-py3-none-any.whl","hashes":{"blake2b_256":"6bca60c827d7ac26d8f8564b29077ee1d5ac94e20471221d9ff323d66eadca4c","md5":"78d645fe0f9d84e754f624b1eb435f98","sha256":"32a52d3affbd88bb00f182da3b8314c757a84c94e8bfe7f341f04e5409383e8f"}},{"filename":"aurum_pay-1.2.0.tar.gz","hashes":{"blake2b_256":"572e1190311136111a551c68b30dfd2743a00ff8b44a4a3d555e742171a26911","md5":"c86d68c96ec7935d1fafcb6a810bbf15","sha256":"95886536c12c787dbac3eb47a409c38da9e9210cf25f7ec91567a8696dbba6dd"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aurum-pay/MAL-2026-19147.json"}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/aurum-pay/1.2.0/"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/c119af2c72f0e68556fc0c7ca0c858845a04b5f46ebb31b614414a5bf470e414/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/aurum-pay"}],"database_specific":{"iocs":{"domains":["aurum-casino.com"],"ips":["209.99.188.130"],"urls":["https://aurum-casino.com/sdk/ping","https://www.dropbox.com/scl/fi/ovn8wxlle1eev6fapq8kv/rcmd-agent?rlkey=mzlx4zi0peodkv8vwdv4tr0v7&st=vv80smtk&dl=1","https://www.dropbox.com/scl/fi/matkw0atxpw24psgn19b8/py.zip?rlkey=w751am7kt5lwi0tmqubj3ozve&st=yafdtm4z&dl=1","http://209.99.188.130:8447"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022586","import_time":"2026-11-11T21:05:21.87422359Z","modified_time":"2026-11-11T20:49:10Z","sha256":"e2b0d2ac6f807a70e04fe3dc30654e40995911bc11ccaec948674e44e243f392","source":"amazon-inspector","versions":["1.2.0"]},{"id":"pypi/2026-11-aurum-pay/aurum-pay","import_time":"2026-11-11T21:05:27.3225988Z","modified_time":"2026-11-11T20:24:40.887978Z","sha256":"40697f79120f5f6ad29a3fe7e3ef4b82f3264c7014b5b6f83e11cc0ccbae366f","source":"kam193","versions":["1.2.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-16251","published":"2026-09-17T14:16:40Z","modified":"2026-11-04T00:45:04.524977682Z","aliases":["GHSA-cvv5-f2cc-586q"],"summary":"Malicious code in tailwindcss-contact-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b)\nPackage presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.\n\n## Source: ghsa-malware (b0cc40255b6caf739a99426695780dbf5621d723fb1a8d2edb049fba3a30d631)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"tailwindcss-contact-form","ecosystem":"npm","purl":"pkg:npm/tailwindcss-contact-form"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.5.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"},{"path":"package.json","sha256":"b8a15fdbb763bf7f22700668956964130dcd94e6aa8c946c9c530461b29b283d","tlsh":"7721a622cd180e7302e0693596f905837297a463895cf8193396c19ccf8d6bfe0f909f"}],"package_integrity":[{"filename":"tailwindcss-contact-form-0.5.1.tgz","hashes":{"sha1":"1b85b6533839b12a1f10cc8baa609d324412a433","sha512_sri":"sha512-KKFOm8kF/qxxkIW8BwSvwCNmszsN2T573UvFFZT8mjgpfMY7sVg4K8O1QBkZJF+OWGeDhhtMDcyqCe35FTXx4A=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-form/MAL-2026-16251.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-form/v/0.5.1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cvv5-f2cc-586q"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020120","import_time":"2026-09-17T14:20:23.161698178Z","modified_time":"2026-09-17T14:16:40Z","sha256":"0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b","source":"amazon-inspector","versions":["0.5.1"]},{"id":"GHSA-cvv5-f2cc-586q","import_time":"2026-11-04T00:37:30.051631791Z","modified_time":"2026-11-04T00:23:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b0cc40255b6caf739a99426695780dbf5621d723fb1a8d2edb049fba3a30d631","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-16251","published":"2026-09-17T14:16:40Z","modified":"2026-11-11T21:15:16.268251147Z","aliases":["GHSA-cvv5-f2cc-586q"],"summary":"Malicious code in tailwindcss-contact-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b)\nPackage presents itself as the Tailwind CSS forms plugin (README is a verbatim copy of @tailwindcss/forms and its package.json points at github.com/tailwindlabs/tailwindcss-forms), and the README instructs users to require('tailwindcss-contact-form') from their tailwind.config.js. The single main file src/index.js is heavily obfuscated (obfuscator.io-style rotated string array, hex identifiers, control-flow flattening) and, when required, imports node:http/node:https and spawn from node:child_process, queries public Ethereum RPCs (eth.drpc.org, ethereum-rpc.publicnode.com, 1rpc.io/eth, public.blastapi.io) and the Blockscout txlist API for outbound transactions of the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts a base64 payload from transaction data (x-payload-B64), and executes it by spawning node. This is a remote-code-execution loader using the Ethereum blockchain as a command-and-control channel: whoever controls the hardcoded key controls code execution on every machine that imports the package. The Tailwind-forms cover story, verbatim README, and forged repository link exist to trick developers into wiring the require() into their build config.\n\n## Source: ghsa-malware (b0cc40255b6caf739a99426695780dbf5621d723fb1a8d2edb049fba3a30d631)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"tailwindcss-contact-form","ecosystem":"npm","purl":"pkg:npm/tailwindcss-contact-form"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.5.1","0.5.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"},{"path":"package.json","sha256":"b8a15fdbb763bf7f22700668956964130dcd94e6aa8c946c9c530461b29b283d","tlsh":"7721a622cd180e7302e0693596f905837297a463895cf8193396c19ccf8d6bfe0f909f"}],"package_integrity":[{"filename":"tailwindcss-contact-form-0.5.1.tgz","hashes":{"sha1":"1b85b6533839b12a1f10cc8baa609d324412a433","sha512_sri":"sha512-KKFOm8kF/qxxkIW8BwSvwCNmszsN2T573UvFFZT8mjgpfMY7sVg4K8O1QBkZJF+OWGeDhhtMDcyqCe35FTXx4A=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-contact-form/MAL-2026-16251.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-form/v/0.5.1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cvv5-f2cc-586q"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-contact-form/v/0.5.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020120","import_time":"2026-09-17T14:20:23.161698178Z","modified_time":"2026-09-17T14:16:40Z","sha256":"0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b","source":"amazon-inspector","versions":["0.5.1"]},{"id":"GHSA-cvv5-f2cc-586q","import_time":"2026-11-04T00:37:30.051631791Z","modified_time":"2026-11-04T00:23:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b0cc40255b6caf739a99426695780dbf5621d723fb1a8d2edb049fba3a30d631","source":"ghsa-malware"},{"id":"IN-MAL-2026-022605","import_time":"2026-11-11T21:05:23.340024556Z","modified_time":"2026-11-11T20:55:39Z","sha256":"6509520e6a5f74baf0d1472f1f638cce8112ecfb35e845e77b95d54f3ac8a936","source":"amazon-inspector","versions":["0.5.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"MAL-2026-16262","published":"2026-09-17T19:51:15Z","modified":"2026-09-17T20:30:05.734283450Z","summary":"Malicious code in tailwindcss-form-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9)\nPackage name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a fully obfuscated (obfuscator.io string-array) module that has nothing to do with Tailwind CSS. On module load it imports node:child_process (spawn), node:http/https, node:zlib and node:url, builds a list of Ethereum JSON-RPC endpoints (process.env.ETH_RPC_URL, *.publicnode.com, drpc.org, 1rpc.io/eth, blockscout) and an Etherscan-style txlist URL for the hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a, and polls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount to retrieve attacker-published transactions. The retrieved payloads are decompressed via gunzip/inflate/brotli and passed to child_process.spawn, giving whoever controls that Ethereum address arbitrary command execution on any host that requires or imports the package. The on-chain command channel is takedown-resistant. The Tailwind-forms identity, the obfuscated main, and the require-time RCE together form a cover-story typosquat delivering installer-side remote code execution.\n","affected":[{"package":{"name":"tailwindcss-form-ui","ecosystem":"npm","purl":"pkg:npm/tailwindcss-form-ui"},"versions":["0.5.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"},{"path":"package.json","sha256":"3d69860a60dfe83778e5d2fdf8e93d8cf796283d9832663ffe00ade9c8a6c79c","tlsh":"a421c822cd140e7301e0293596f905837297a463895cf81a3396c19ccf8d6bfe0f909f"}],"package_integrity":[{"filename":"tailwindcss-form-ui-0.5.1.tgz","hashes":{"sha1":"6ad4e9d33db7ff1f025da8ee3be606323f0f48ca","sha512_sri":"sha512-pukhSsK+8SK6vgskhwNxkr5IlhRnIEtpu84CISV2zwKNY8gQ01l8NMMDCIdoKlUMFh16b+l9O23Fe0r/6H3wiQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form-ui/MAL-2026-16262.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-form-ui/v/0.5.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020139","import_time":"2026-09-17T20:18:44.980237849Z","modified_time":"2026-09-17T19:51:15Z","sha256":"c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9","source":"amazon-inspector","versions":["0.5.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-16262","published":"2026-09-17T19:51:15Z","modified":"2026-11-11T21:15:15.024670154Z","summary":"Malicious code in tailwindcss-form-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba05c76200656d6746f6f200e1e45f8027d4c87bb6b2312b9690aad262ddf39c)\ntailwindcss-form-ui@0.5.8 impersonates @tailwindcss/forms: package.json sets author to '@tailwindcss' and repository to https://github.com/tailwindlabs/tailwindcss-forms while publishing under an unrelated name, and the README and plugin source are verbatim copies of the real @tailwindcss/forms with a malicious preamble added. The declared main entry src/index.js prepends ~15 KB of obfuscated code to the copied plugin. A custom deterministic string-shuffle primitive (functions named spin/peel/splitLane with hardcoded seed arrays) reconstructs the identifiers 'constructor', 'require', 'module', and 'global' at runtime, then invokes the Function constructor on a decoded code blob and immediately calls the resulting function with require bound as a local parameter: Forge('z', peel('<decoded body>'))(require). This executes attacker-controlled code with full Node module access the moment any consumer require()s the package. A Tailwind CSS plugin has no legitimate need to construct and run dynamically-decoded code at import time or to pass require into it; the obfuscation primitive exists only to hide the stager from static review.\n","affected":[{"package":{"name":"tailwindcss-form-ui","ecosystem":"npm","purl":"pkg:npm/tailwindcss-form-ui"},"versions":["0.5.1","0.5.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"f5fd0ca9d7642087d0edf609c126197b4d958cc2e1d576c62d444287444e229d","tlsh":"9503e9957e81121a33434f7fba1bf4e4e12a1899369448c7d21cbc94f8e631ae9f6d34"},{"path":"package.json","sha256":"3d69860a60dfe83778e5d2fdf8e93d8cf796283d9832663ffe00ade9c8a6c79c","tlsh":"a421c822cd140e7301e0293596f905837297a463895cf81a3396c19ccf8d6bfe0f909f"}],"package_integrity":[{"filename":"tailwindcss-form-ui-0.5.1.tgz","hashes":{"sha1":"6ad4e9d33db7ff1f025da8ee3be606323f0f48ca","sha512_sri":"sha512-pukhSsK+8SK6vgskhwNxkr5IlhRnIEtpu84CISV2zwKNY8gQ01l8NMMDCIdoKlUMFh16b+l9O23Fe0r/6H3wiQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-form-ui/MAL-2026-16262.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-form-ui/v/0.5.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-form-ui/v/0.5.8"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020139","import_time":"2026-09-17T20:18:44.980237849Z","modified_time":"2026-09-17T19:51:15Z","sha256":"c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9","source":"amazon-inspector","versions":["0.5.1"]},{"id":"IN-MAL-2026-022602","import_time":"2026-11-11T21:05:23.139955637Z","modified_time":"2026-11-11T20:55:16Z","sha256":"ba05c76200656d6746f6f200e1e45f8027d4c87bb6b2312b9690aad262ddf39c","source":"amazon-inspector","versions":["0.5.8"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18484","published":"2026-11-02T17:17:45Z","modified":"2026-11-02T18:30:04.778037617Z","aliases":["GHSA-whfc-859g-h5j3"],"summary":"Malicious code in internal-renderers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"internal-renderers","ecosystem":"npm","purl":"pkg:npm/internal-renderers"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internal-renderers/MAL-2026-18484.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-whfc-859g-h5j3"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-whfc-859g-h5j3","import_time":"2026-11-02T18:20:26.928775189Z","modified_time":"2026-11-02T17:17:46Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a","source":"ghsa-malware"}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18484","published":"2026-11-02T17:17:45Z","modified":"2026-11-11T21:45:04.517336093Z","aliases":["GHSA-whfc-859g-h5j3"],"summary":"Malicious code in internal-renderers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d5f9a7272f857bde925f1f22ec114119eab70458f07f935c16179d40939db89)\nThe package's preinstall and postinstall lifecycle scripts in package.json issue plain-HTTP GET requests to the hardcoded bare IP endpoint http://38.242.235.206/depconf/internal-renderers/preinstall and /postinstall. Each request transmits the installer's OS username (process.env.USER or USERNAME), hostname (os.hostname()), and current working directory (process.cwd()) as URL query parameters. The requests fire automatically and unconditionally during `npm install`. The destination is a bare IPv4 address unrelated to any legitimate publisher, uses cleartext HTTP, and the package name combined with the version 10.0.0 and the `/depconf/` URL path are consistent with a dependency-confusion probe designed to detect and fingerprint internal build environments that resolve this public name instead of a private internal package. The shipped code performs no other functionality; the sole effect of installing this package is the identity beacon.\n\n## Source: ghsa-malware (278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"internal-renderers","ecosystem":"npm","purl":"pkg:npm/internal-renderers"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["10.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"97b10e92edda14c4d34c5a1f64741bab9fd7ca079d2730a67f26dcb7680e7408","tlsh":"5a211eb0c1109e6988c611e8533f080fd2fa71974aad0c00671212aa07af6e1873b67f"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internal-renderers/MAL-2026-18484.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-whfc-859g-h5j3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/internal-renderers/v/10.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-whfc-859g-h5j3","import_time":"2026-11-02T18:20:26.928775189Z","modified_time":"2026-11-02T17:17:46Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a","source":"ghsa-malware"},{"id":"IN-MAL-2026-022616","import_time":"2026-11-11T21:36:50.725042947Z","modified_time":"2026-11-11T21:10:22Z","sha256":"2d5f9a7272f857bde925f1f22ec114119eab70458f07f935c16179d40939db89","source":"amazon-inspector","versions":["10.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18773","published":"2026-11-09T01:25:27Z","modified":"2026-11-09T02:30:04.721125821Z","aliases":["GHSA-hh7j-5m3j-23pf"],"summary":"Malicious code in @ethersphere/bee-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (4e40e7247019419a32a3f25176f5df039894ce096f8105dfc4a7b40383034d49)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@ethersphere/bee-js","ecosystem":"npm","purl":"pkg:npm/%40ethersphere/bee-js"},"versions":["13.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ethersphere/bee-js/MAL-2026-18773.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hh7j-5m3j-23pf"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hh7j-5m3j-23pf","import_time":"2026-11-09T02:23:20.429054075Z","modified_time":"2026-11-09T01:25:27Z","sha256":"4e40e7247019419a32a3f25176f5df039894ce096f8105dfc4a7b40383034d49","source":"ghsa-malware","versions":["13.3.0"]}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18773","published":"2026-11-09T01:25:27Z","modified":"2026-11-11T21:15:15.105411171Z","aliases":["GHSA-hh7j-5m3j-23pf"],"summary":"Malicious code in @ethersphere/bee-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1d7ae78f34be2e7dfca204732ab963eaf80303ef56b30a20ad3f3860303d91d3)\nThe package declares a postinstall hook, scripts/generate-version.cjs, that performs an HTTPS GET to https://api.frameworkmetrics.xyz/v1/analytics, concatenates the response body, and passes it to new Function('require','console','process', body)(require, console, process). The fetched bytes are executed as JavaScript inside the installing Node process with full access to require, console, and process, giving the operator of api.frameworkmetrics.xyz arbitrary remote code execution on every machine that runs `npm install @ethersphere/bee-js@13.3.0`. The destination domain is unrelated to the declared publisher (github.com/ethersphere/bee-js); no pinning, hash, or signature is used, and errors in the fetch are suppressed. The file is named and commented as a version-generator that rewrites src/version.ts, but the version-generation branch is guarded by fs.existsSync(srcDir), which is not satisfied in a normal consumer install, while the network fetch and new Function() invocation run unconditionally; a comment on the control-flow explicitly notes that `process.exit` was avoided so the fetch would not be cut short. The benign filename, documented purpose, and 'analytics' framing serve as a cover story for the install-time remote JavaScript execution channel.\n\n## Source: ghsa-malware (4e40e7247019419a32a3f25176f5df039894ce096f8105dfc4a7b40383034d49)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@ethersphere/bee-js","ecosystem":"npm","purl":"pkg:npm/%40ethersphere/bee-js"},"versions":["13.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/generate-version.cjs","sha256":"ee2f762e9ed3fd89f106e0b80c2e923bf1aed9a280277d3d998a5902c4d9ec0f","tlsh":"2e5151ab14ecc3345d508bd6620e44427369c3713721f4b1b28d919a3b86d88a2f3afa"}],"package_integrity":[{"filename":"bee-js-13.3.0.tgz","hashes":{"sha1":"a205c8a5fed81e9a787645b2801f00be3db3348d","sha512_sri":"sha512-ltkrphoNy7TBIjCICDW7y3qa+j8yljt3+ohPRSM+id1rK2NaOgm5H5V/FioTQ0rEJ5IJ+Zj1micbAdQCqqc8iw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ethersphere/bee-js/MAL-2026-18773.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hh7j-5m3j-23pf"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ethersphere/bee-js/v/13.3.0"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hh7j-5m3j-23pf","import_time":"2026-11-09T02:23:20.429054075Z","modified_time":"2026-11-09T01:25:27Z","sha256":"4e40e7247019419a32a3f25176f5df039894ce096f8105dfc4a7b40383034d49","source":"ghsa-malware","versions":["13.3.0"]},{"id":"IN-MAL-2026-022608","import_time":"2026-11-11T21:05:23.571847666Z","modified_time":"2026-11-11T21:02:48Z","sha256":"1d7ae78f34be2e7dfca204732ab963eaf80303ef56b30a20ad3f3860303d91d3","source":"amazon-inspector","versions":["13.3.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18797","published":"2026-11-09T17:47:06Z","modified":"2026-11-09T19:30:08.629518821Z","aliases":["GHSA-xmgv-vmf4-rqpp"],"summary":"Malicious code in file-saver-bg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (fb2c5b4b6b375b1e32fa020b91c41061e43028b84baded3d7ac0aa49fe67d2f7)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"file-saver-bg","ecosystem":"npm","purl":"pkg:npm/file-saver-bg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/file-saver-bg/MAL-2026-18797.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xmgv-vmf4-rqpp"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-xmgv-vmf4-rqpp","import_time":"2026-11-09T19:17:53.614290516Z","modified_time":"2026-11-09T17:47:06Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"fb2c5b4b6b375b1e32fa020b91c41061e43028b84baded3d7ac0aa49fe67d2f7","source":"ghsa-malware"}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18797","published":"2026-11-09T17:47:06Z","modified":"2026-11-11T21:15:15.130428024Z","aliases":["GHSA-xmgv-vmf4-rqpp"],"summary":"Malicious code in file-saver-bg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc60a9083c9eef36fa2df3fbf6f9123aea7ddcf1f244b28ce480f8440d0c6380)\nfile-saver-bg@9.9.9 is a dependency-confusion-shaped package (name resembles 'file-saver', implausibly high version 9.9.9 to win internal resolution) whose package.json declares both preinstall and postinstall lifecycle scripts invoking beacon.js. beacon.js collects os.hostname(), os.userInfo().username, process.cwd(), and os.platform() and transmits them as query parameters in an HTTP GET to the hardcoded bare-IP endpoint http://100.24.177.136/cb. The beacon fires automatically on npm install without any user interaction, disclosing internal build-host identifiers to an attacker-controlled destination.\n\n## Source: ghsa-malware (fb2c5b4b6b375b1e32fa020b91c41061e43028b84baded3d7ac0aa49fe67d2f7)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"file-saver-bg","ecosystem":"npm","purl":"pkg:npm/file-saver-bg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["9.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"1c8cf0eacb5033593c20dd24459266b2d72a4a5884b8ebfd83e483b3b8fa96fb","tlsh":"e00183f67110c7698e4d08e8a4bf2e9da1fbb3908ce52d80d879c2c45b704602a0b77b"},{"path":"package.json","sha256":"bada79a0b41753d9fb57528af3fe3c11b356c8040483c9e557569f880092fa7a","tlsh":"31d02e818c00be3720f48aea0832115bb1318f5e22380c0bb8f3406c011aa6502a3717"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/file-saver-bg/MAL-2026-18797.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xmgv-vmf4-rqpp"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/file-saver-bg/v/9.9.9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-xmgv-vmf4-rqpp","import_time":"2026-11-09T19:17:53.614290516Z","modified_time":"2026-11-09T17:47:06Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"fb2c5b4b6b375b1e32fa020b91c41061e43028b84baded3d7ac0aa49fe67d2f7","source":"ghsa-malware"},{"id":"IN-MAL-2026-022610","import_time":"2026-11-11T21:05:23.704389944Z","modified_time":"2026-11-11T21:03:31Z","sha256":"dc60a9083c9eef36fa2df3fbf6f9123aea7ddcf1f244b28ce480f8440d0c6380","source":"amazon-inspector","versions":["9.9.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18798","published":"2026-11-09T17:47:06Z","modified":"2026-11-09T19:30:08.333915227Z","aliases":["GHSA-2gfg-q28v-5gh9"],"summary":"Malicious code in react-bootstrap-table-next-bg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (a11f8ac581f8b8cc2ff1bec698360084c46b97d1dd5ef86e927bdf048d4d9f44)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"react-bootstrap-table-next-bg","ecosystem":"npm","purl":"pkg:npm/react-bootstrap-table-next-bg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-bootstrap-table-next-bg/MAL-2026-18798.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2gfg-q28v-5gh9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-2gfg-q28v-5gh9","import_time":"2026-11-09T19:17:53.594331633Z","modified_time":"2026-11-09T17:47:07Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a11f8ac581f8b8cc2ff1bec698360084c46b97d1dd5ef86e927bdf048d4d9f44","source":"ghsa-malware"}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18798","published":"2026-11-09T17:47:06Z","modified":"2026-11-11T21:15:15.147508436Z","aliases":["GHSA-2gfg-q28v-5gh9"],"summary":"Malicious code in react-bootstrap-table-next-bg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d0196f2878a726d01c33ac3e50ce4d60a66679c39de237ceeace336c525f9451)\nreact-bootstrap-table-next-bg@9.9.9 is a dependency-confusion squat on the react-bootstrap-table-next name, published at an inflated 9.9.9 version to win resolution against internal pins. package.json declares both preinstall and postinstall hooks that run `node beacon.js`, which issues an HTTP GET to the hardcoded bare-IP endpoint http://100.24.177.136/cb with query parameters carrying the installer's hostname, OS username, current working directory, and platform. Installation on any machine that resolves this public name causes those host identifiers to be transmitted in cleartext to the attacker-controlled endpoint, and the lifecycle-script mechanism itself gives the publisher arbitrary code execution on the installer's host at install time.\n\n## Source: ghsa-malware (a11f8ac581f8b8cc2ff1bec698360084c46b97d1dd5ef86e927bdf048d4d9f44)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"react-bootstrap-table-next-bg","ecosystem":"npm","purl":"pkg:npm/react-bootstrap-table-next-bg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["9.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"2e0bc5bd9e7cb47a5436401eaf2bfbca19e625217f16194d6611d72ec9e70f78","tlsh":"c20194f97110c7998d4d08e8607f199da0fb73908cd51d80c57cc2c05b704a5261b67b"},{"path":"package.json","sha256":"5ef15dc2653126c70d7e398ffbdd5145b0600ed1a17314ba25ef3f5661f2cada","tlsh":"23d02b45cd007e7324f589ee1836015bb0314f6e23380c4b74f3405c5116aba41a3706"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-bootstrap-table-next-bg/MAL-2026-18798.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2gfg-q28v-5gh9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-bootstrap-table-next-bg/v/9.9.9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-2gfg-q28v-5gh9","import_time":"2026-11-09T19:17:53.594331633Z","modified_time":"2026-11-09T17:47:07Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a11f8ac581f8b8cc2ff1bec698360084c46b97d1dd5ef86e927bdf048d4d9f44","source":"ghsa-malware"},{"id":"IN-MAL-2026-022611","import_time":"2026-11-11T21:05:23.765599296Z","modified_time":"2026-11-11T21:03:39Z","sha256":"d0196f2878a726d01c33ac3e50ce4d60a66679c39de237ceeace336c525f9451","source":"amazon-inspector","versions":["9.9.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18800","published":"2026-11-09T17:32:58Z","modified":"2026-11-09T19:30:08.471834098Z","aliases":["GHSA-7jvp-3chx-w4r9"],"summary":"Malicious code in template-cards (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (a92510a22366de728e3ff108fed3d501566c544d1e74eaf4fa04c608f43bd601)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"template-cards","ecosystem":"npm","purl":"pkg:npm/template-cards"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/template-cards/MAL-2026-18800.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7jvp-3chx-w4r9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-7jvp-3chx-w4r9","import_time":"2026-11-09T19:17:53.600045024Z","modified_time":"2026-11-09T17:32:58Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a92510a22366de728e3ff108fed3d501566c544d1e74eaf4fa04c608f43bd601","source":"ghsa-malware"}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18800","published":"2026-11-09T17:32:58Z","modified":"2026-11-11T21:15:16.282318860Z","aliases":["GHSA-7jvp-3chx-w4r9"],"summary":"Malicious code in template-cards (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (417229f0823e3d64337cb454c2a3d7b8644bfd0eb4f676875f82eba80838f97f)\nbeacon.cjs defines BEACON = \"http://13.140.137.222:8787/_ah/dc\" and a fire() function that POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), the Node.js version, and the package name to that hardcoded bare IP over cleartext HTTP. The package wires this to fire automatically on default install: package.json scripts.postinstall runs \"node beacon.cjs\", and index.js calls require('./beacon.cjs').fire() at top level, so a consumer require() also triggers the beacon. The destination is not caller-configurable and is not disclosed. The package self-describes as a \"Compatibility shim\" and exports an inert Proxy with no functional surface, so the beacon is the package's only effect. The combination of a hollow stub main, a hardcoded bare-IP plain-HTTP destination, and dual install+import execution matches a dependency-confusion / install-beacon reconnaissance package used to confirm execution inside internal build environments.\n\n## Source: ghsa-malware (a92510a22366de728e3ff108fed3d501566c544d1e74eaf4fa04c608f43bd601)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"template-cards","ecosystem":"npm","purl":"pkg:npm/template-cards"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["16.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"7eaed39d28ac19364cb0f207063927516d4dceb02689434128d1b3a88bfb2b29","tlsh":"f1314feba4e1e048aeaa7098c54f1508b27bf4078501ab50fd5c83959f6197c33fa8dc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/template-cards/MAL-2026-18800.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7jvp-3chx-w4r9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/template-cards/v/16.1.1"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-7jvp-3chx-w4r9","import_time":"2026-11-09T19:17:53.600045024Z","modified_time":"2026-11-09T17:32:58Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a92510a22366de728e3ff108fed3d501566c544d1e74eaf4fa04c608f43bd601","source":"ghsa-malware"},{"id":"IN-MAL-2026-022614","import_time":"2026-11-11T21:05:23.982310545Z","modified_time":"2026-11-11T21:04:29Z","sha256":"417229f0823e3d64337cb454c2a3d7b8644bfd0eb4f676875f82eba80838f97f","source":"amazon-inspector","versions":["16.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18801","published":"2026-11-09T17:32:58Z","modified":"2026-11-09T19:30:08.626752589Z","aliases":["GHSA-f6cc-wp5p-cq33"],"summary":"Malicious code in template-pictogram (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"template-pictogram","ecosystem":"npm","purl":"pkg:npm/template-pictogram"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/template-pictogram/MAL-2026-18801.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f6cc-wp5p-cq33"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-f6cc-wp5p-cq33","import_time":"2026-11-09T19:17:53.606405205Z","modified_time":"2026-11-09T17:32:59Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109","source":"ghsa-malware"}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18801","published":"2026-11-09T17:32:58Z","modified":"2026-11-11T21:15:16.220062644Z","aliases":["GHSA-f6cc-wp5p-cq33"],"summary":"Malicious code in template-pictogram (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7eb68b10a3e28c16855bcd33931e1fb6e5e997e44d3b25d12b1e11d9c118ec74)\ntemplate-pictogram@9.1.1 is a stub package whose `package.json` main is a Proxy returning no-op functions for every property, with no advertised functionality beyond a shim. Its `postinstall` script runs `beacon.cjs`, which collects hostname, install path, cwd, user-agent, and Node.js version and POSTs them to the hardcoded bare-IP, plain-HTTP endpoint http://13.140.137.222:8787/_ah/dc. The same beacon also fires when the module is `require()`'d. The destination is unrelated to any documented publisher and is reached over cleartext HTTP to a bare IPv4 address.\n\n## Source: ghsa-malware (3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"template-pictogram","ecosystem":"npm","purl":"pkg:npm/template-pictogram"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["9.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"76ac6a6972303785e3f2ffc9e6c50cec29a79b707c3b51cdb3498d11e35df1dc","tlsh":"e8316feba4e0e048aeaa70a8c54f0408b27bf0079501ab50fd5c83959f7193c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/template-pictogram/MAL-2026-18801.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f6cc-wp5p-cq33"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/template-pictogram/v/9.1.1"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-f6cc-wp5p-cq33","import_time":"2026-11-09T19:17:53.606405205Z","modified_time":"2026-11-09T17:32:59Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109","source":"ghsa-malware"},{"id":"IN-MAL-2026-022613","import_time":"2026-11-11T21:05:23.910650043Z","modified_time":"2026-11-11T21:04:21Z","sha256":"7eb68b10a3e28c16855bcd33931e1fb6e5e997e44d3b25d12b1e11d9c118ec74","source":"amazon-inspector","versions":["9.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18802","published":"2026-11-09T17:32:58Z","modified":"2026-11-09T19:30:08.331962009Z","aliases":["GHSA-xx2g-pxvx-74hr"],"summary":"Malicious code in template-projection-map (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"template-projection-map","ecosystem":"npm","purl":"pkg:npm/template-projection-map"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/template-projection-map/MAL-2026-18802.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xx2g-pxvx-74hr"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-xx2g-pxvx-74hr","import_time":"2026-11-09T19:17:53.615312623Z","modified_time":"2026-11-09T17:32:59Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04","source":"ghsa-malware"}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18802","published":"2026-11-09T17:32:58Z","modified":"2026-11-11T21:15:16.319166388Z","aliases":["GHSA-xx2g-pxvx-74hr"],"summary":"Malicious code in template-projection-map (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fe3cf14f1af4fe35fdc9c8635c3a4fa24e1d64610782d298d3e428446ce7f02c)\ntemplate-projection-map@22.1.1 is a functionally empty npm package whose only behavior is a reconnaissance beacon. The package.json postinstall hook executes beacon.cjs, which POSTs the installer's hostname (os.hostname()), install path (__dirname), current working directory (process.cwd()), and Node.js version to the hardcoded plain-HTTP bare-IP endpoint http://13.140.137.222:8787/_ah/dc. The same beacon is also fired from index.js at require() time via require('./beacon.cjs').fire(). index.js otherwise exports a Proxy whose every property returns a no-op, confirmed by the module's self-description as a Compatibility shim. The destination is a bare IPv4 address over cleartext HTTP, unrelated to any legitimate publisher infrastructure, and the package provides no advertised functionality that could justify such telemetry. The shape (install- and import-time outbound POST of host identifiers to an attacker-controlled endpoint on a stub/name-squat package) matches dependency-confusion reconnaissance tooling.\n\n## Source: ghsa-malware (39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"template-projection-map","ecosystem":"npm","purl":"pkg:npm/template-projection-map"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.1.3","22.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"16c12f1df35c895b81fda5a233b4df764f2779bd78e01b800fc472cf938381bc","tlsh":"d33120eba4e1e048aaaa7498c54f1409f277f4068501ab50fd5c82959f6153c33fa8dc"},{"path":"index.js","sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d","tlsh":"2201d0d7225661b10b5221a4978f43c4a3b99d74027941d0d84a9226365108c463b8ee"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/template-projection-map/MAL-2026-18802.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xx2g-pxvx-74hr"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/template-projection-map/v/99.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/template-projection-map/v/22.1.1"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-xx2g-pxvx-74hr","import_time":"2026-11-09T19:17:53.615312623Z","modified_time":"2026-11-09T17:32:59Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04","source":"ghsa-malware"},{"id":"IN-MAL-2026-022615","import_time":"2026-11-11T21:05:24.042860108Z","modified_time":"2026-11-11T21:04:35Z","sha256":"859881aae3408aa5db5bc1da4c13c86dee8848d719f0452582f7d7fd7b8c6a37","source":"amazon-inspector","versions":["99.1.3"]},{"id":"IN-MAL-2026-022612","import_time":"2026-11-11T21:05:23.839686825Z","modified_time":"2026-11-11T21:04:15Z","sha256":"fe3cf14f1af4fe35fdc9c8635c3a4fa24e1d64610782d298d3e428446ce7f02c","source":"amazon-inspector","versions":["22.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19142","published":"2026-11-11T21:01:46Z","modified":"2026-11-11T21:15:15.958966905Z","summary":"Malicious code in fcefi-wdojs-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9)\nfcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared `_bz` numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of `CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `TRAVIS`, `CIRCLECI`, or `SANDBOX` are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.\n","affected":[{"package":{"name":"fcefi-wdojs-util","ecosystem":"npm","purl":"pkg:npm/fcefi-wdojs-util"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"95618430decba4e2a9241dbc787a7f5aa0a688797e2f648212c7d263f3738ba2","tlsh":"88e0e54cb3b955185891db99a42dae0264f2bad60a958461a654b1832bb0b180b5241f"},{"path":"package.json","sha256":"7419d2631c75a6d36abc4b690f9a86c824d020a3621d24d7420bd7c9357be6dc","tlsh":"610210d61c0378d9b15cc97a107932454494bc23ac56fc8970aa4a834fef12e2bfee39"},{"path":"lib/native.pkg_config","sha256":"1f6f1d1d1a2aab2daf8b4332b597522a445f70097128fa4b008822f1f218d157","tlsh":"14d5bfbc76047de6266f576bda96acdc03b627639acba4cc8064b7c30563375fe02805"}],"package_integrity":[{"filename":"fcefi-wdojs-util-1.0.0.tgz","hashes":{"sha1":"03e9b0ae9968cecc960286830c198a6bc3775730","sha512_sri":"sha512-prEBkDmY0C0p5ICO5nCLu39iT3jC4+YWLuA4reVqsYW3ft54dObX0+FEaL1DU5qa6ip5LigutT6RS5yJUCztVA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fcefi-wdojs-util/MAL-2026-19142.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fcefi-wdojs-util/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022606","import_time":"2026-11-11T21:05:23.410349476Z","modified_time":"2026-11-11T21:01:46Z","sha256":"07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19143","published":"2026-11-11T21:02:24Z","modified":"2026-11-11T21:15:16.012095738Z","summary":"Malicious code in mock-data-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0)\nThe package presents itself as a mock-data generator but hides a base64-encoded JavaScript payload across the `mark` fields of data/products_*.js. The library entrypoint (index.js) concatenates those fields, decodes the result with Buffer.from(..., 'base64').toString('utf-8'), and executes it via the Function() constructor with Buffer, require, and process passed in as arguments. The identifiers 'Buffer', 'require', 'process', and 'new Function' are reconstructed at runtime from an XOR-obfuscated table keyed by a derived 4-byte seed, which conceals the eval sink from string-based scanners. The exported getTransactions() API triggers this execution on every call. The decoded payload loads python-shell and https, writes a Python script to /tmp/targets, and recursively walks the filesystem (pathlib.Path(root).rglob('*')) for file names containing 'password', 'wallet', 'seed', 'privatekey', or '.env'. The advertised purpose (mock data) has no legitimate need to enumerate credential-, wallet-, and dotenv-shaped files on the installer's host or to run arbitrary code reconstructed from pseudo-data files.\n","affected":[{"package":{"name":"mock-data-sdk","ecosystem":"npm","purl":"pkg:npm/mock-data-sdk"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"bcd159fca68ccb2d4b920cef97c36e3dfdfc417c594c7716ccbd59ad7915454b","tlsh":"c1d100ac3bfc2028881bb26826db4449652dd0571e9a7ce87f4cc2417f2d17cd2f6b58"},{"path":"data/products_1.js","sha256":"98a6ac1cc9d8420b07c2f269846f97d22c606026b3dca05a04518c3029df16b0","tlsh":"54522e79cb780c9761091ca05af6094a7290475b0fea3e467f4dd54c8f9cc5f84ba62f"}],"package_integrity":[{"filename":"mock-data-sdk-1.0.1.tgz","hashes":{"sha1":"343aa32b625dbdb9de897afe891dde4ba61e8e89","sha512_sri":"sha512-gWOcc8igVHl+OKsWDVpnIybv1WXhcwHgSgp0wcdr6JrBNASYSWoS2omuDO8S01Od3LWvAhtQ3EzQpxX8m1pFAg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mock-data-sdk/MAL-2026-19143.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mock-data-sdk/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022607","import_time":"2026-11-11T21:05:23.50413818Z","modified_time":"2026-11-11T21:02:24Z","sha256":"f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19145","published":"2026-11-11T20:55:10Z","modified":"2026-11-11T21:15:16.215930452Z","summary":"Malicious code in tailwindcss-hook-forms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef)\nThe package impersonates @tailwindcss/forms: name, repository (tailwindlabs/tailwindcss-forms), author (@tailwindcss), README, CHANGELOG, and HTML are copied from the legitimate plugin, with a demo link to tailwindcss-hook-forms.vercel.app. src/index.js prepends a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor via peel.constructor and immediately invokes a function compiled from a ~15KB opaque, obfuscated string literal, passing the host require into it. This fires whenever any consumer imports the package, running attacker-controlled code in the installer's Node.js process with full access to require, process, filesystem, and network. The subsequent code replicates the public API of @tailwindcss/forms as cover. The obfuscator scheme does not exist in the legitimate plugin and its only purpose is to conceal the executable body from review.\n","affected":[{"package":{"name":"tailwindcss-hook-forms","ecosystem":"npm","purl":"pkg:npm/tailwindcss-hook-forms"},"versions":["0.5.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.js","sha256":"860f4933ca8ff3d4b7b09fb1d4eab7caaf69dc5ab5f9f04193040a921ff265ae","tlsh":"89b24b2b3413033bb9138c784adaa8f0760db01577b4c3e5f4ad80b05f8a5e8a576e9d"},{"path":"package.json","sha256":"3970683d138585b1304ade506824ff3754de3432470db6f8d31025e122790f9e","tlsh":"e121a526cd140e7302d0283596f90183b2979863895cbc193396c19c8f8d5bfe0fa09e"}],"package_integrity":[{"filename":"tailwindcss-hook-forms-0.5.2.tgz","hashes":{"sha1":"0ee686bb29beeea912396b45341877f03dd9fe70","sha512_sri":"sha512-ZflHPkmXX3GuqTZaZMKV7WCle3GYJ/AMnX/AJ2x+NE+ZHa9L8xs8F6FeJrpFEgm/hdvLd5DMxdihZDd3TH2VCw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tailwindcss-hook-forms/MAL-2026-19145.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tailwindcss-hook-forms/v/0.5.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022601","import_time":"2026-11-11T21:05:23.027300784Z","modified_time":"2026-11-11T20:55:10Z","sha256":"d504fed314f875b17a90d039af71b0798636e5030373e5d959871dc356bc7bef","source":"amazon-inspector","versions":["0.5.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19146","published":"2026-11-11T21:03:21Z","modified":"2026-11-11T21:15:16.005902231Z","summary":"Malicious code in teahy-znrpz-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d)\nindex.js reads a numeric byte array stored under a non-standard `_bz` key inside package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with `require` and `__dirname` bound in — all on module load. Execution is gated by an early-return when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the hidden code only runs on real developer or production hosts. Smuggling executable logic as a zlib blob under a private manifest key, decoding it, and running it through Function() at require time is an obfuscated-loader pattern; the package's self-description as a 'utility' does not match any behavior visible in its source. The payload executes with full Node privileges on the installer's machine as soon as the module is required.\n","affected":[{"package":{"name":"teahy-znrpz-util","ecosystem":"npm","purl":"pkg:npm/teahy-znrpz-util"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"95618430decba4e2a9241dbc787a7f5aa0a688797e2f648212c7d263f3738ba2","tlsh":"88e0e54cb3b955185891db99a42dae0264f2bad60a958461a654b1832bb0b180b5241f"}],"package_integrity":[{"filename":"teahy-znrpz-util-1.0.0.tgz","hashes":{"sha1":"717d7d22cb4149ed7afc2052fa4b204bbf752229","sha512_sri":"sha512-ICzlXwjQIPi2MfU/mb3sqGXX1WSfajsRlJFWlNv/5yxdJylwDT3S2NjSDRkM55i3FfAXcyU0ZhKiF7TtbRsLzw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/teahy-znrpz-util/MAL-2026-19146.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/teahy-znrpz-util/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022609","import_time":"2026-11-11T21:05:23.639620173Z","modified_time":"2026-11-11T21:03:21Z","sha256":"5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
|
||||
+12
-12
@@ -31,16 +31,16 @@
|
||||
"records": 4291
|
||||
},
|
||||
"Packagist": {
|
||||
"etag": "\"33cd85e43eaaa872adb7d5a2a05ea651\"",
|
||||
"last_modified": "Tue, 10 Nov 2026 20:18:08 GMT",
|
||||
"last_success": "2026-11-10T20:34:56.287146+00:00",
|
||||
"records": 7422
|
||||
"etag": "\"5fa84935cc3bee733e5885b82560c14e\"",
|
||||
"last_modified": "Wed, 11 Nov 2026 18:48:24 GMT",
|
||||
"last_success": "2026-11-12T00:43:51.065272+00:00",
|
||||
"records": 7446
|
||||
},
|
||||
"PyPI": {
|
||||
"etag": "\"75548fd5b36823e8b36196f008408c1a\"",
|
||||
"last_modified": "Wed, 11 Nov 2026 10:33:08 GMT",
|
||||
"last_success": "2026-11-11T12:42:28.640598+00:00",
|
||||
"records": 26862
|
||||
"etag": "\"014b44fea16398dbe538339471ea66d3\"",
|
||||
"last_modified": "Wed, 11 Nov 2026 23:48:14 GMT",
|
||||
"last_success": "2026-11-12T00:41:41.473406+00:00",
|
||||
"records": 26863
|
||||
},
|
||||
"RubyGems": {
|
||||
"etag": "\"b38b3597289377dfc31f237d94a35f67\"",
|
||||
@@ -55,10 +55,10 @@
|
||||
"records": 3093
|
||||
},
|
||||
"npm": {
|
||||
"etag": "\"6b79d1e35f8137dd20011bab0947794e\"",
|
||||
"last_modified": "Wed, 11 Nov 2026 17:48:14 GMT",
|
||||
"last_success": "2026-11-11T18:46:17.881918+00:00",
|
||||
"records": 231690
|
||||
"etag": "\"17766fa491341832cc26941cdb03cba7\"",
|
||||
"last_modified": "Wed, 11 Nov 2026 21:48:35 GMT",
|
||||
"last_success": "2026-11-12T00:43:45.180461+00:00",
|
||||
"records": 231695
|
||||
}
|
||||
},
|
||||
"version": 1
|
||||
|
||||
Reference in New Issue
Block a user