The npm package mini-hardhat version 1.1.4 contains malicious code that masquerades as a JSON logger but actually spawns a detached child process. This child process fetches and executes remote code from an obfuscated URL, enabling arbitrary code execution within the user's Node.js environment. The malicious behavior is engineered to persist beyond the parent process, making it a remote code execution dropper.
The npm package native-env@1.0.1 is a malicious package masquerading as a zero-dependency dotenv toolkit. On Windows, it executes attacker-controlled code immediately upon being required or run. It uses a JPEG file as a payload carrier to evade static scanners, writes a VBScript to the temp directory, and launches a PowerShell command with an encoded payload. The package is a typosquatting attempt targeting dotenv-family packages.
The npm package dotenv-native (version 1.0.1) is a malicious typosquat of the popular dotenv package family. It executes attacker-controlled code on module load by extracting and decoding a hidden payload from a bundled JPEG file, writing a VBScript file, and launching PowerShell with an encoded command on Windows hosts. The package also includes an obfuscated decode-and-eval remote code execution primitive. Both requiring the package as a dependency or running its CLI triggers the malicious payload.
The npm package fabric-native-loader version 1.0.0 contains malicious code that executes during installation. It steals Minecraft launcher credentials and related tokens from various launcher files and system information, then sends this data to a hardcoded Discord webhook. The package does not provide any legitimate functionality matching its name and solely acts to exfiltrate sensitive user credentials.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d)
On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.
The npm package 'test-agency-assignment' version 1.0.2 contains malicious code that executes automatically on Windows hosts during installation. It uses a postinstall script to run a Visual Basic Script (VBS) that decrypts and loads a PowerShell payload designed for process hollowing, enabling arbitrary code execution. The package masquerades as a benign telemetry tool but functions solely as a dropper for attacker-controlled code.
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Nodemailer versions from 5.0.0 up to 10.0.1 have a vulnerability in their process-global DNS cache that causes TLS server name indication (SNI) to be reused incorrectly across SMTP transports. This flaw allows one tenant in a multi-tenant environment to cause another tenant's SMTP transport to use the attacker's TLS server name and certificate, leading to potential SMTP credential disclosure. The issue arises because the DNS cache key is only the host, but the cached value includes the TLS server name, which is overwritten and reused improperly. No official patch was available at the time of this report.
CVE-2026-101204 is an out-of-bounds read vulnerability in FastStone Image Viewer up to version 8.3, specifically in the TGA Image Handler component of FSViewer.exe. This vulnerability can be triggered remotely and may lead to information disclosure or application instability. The vendor has not responded to the disclosure, and no patch or fix is currently available. The CVSS score is 5.3, indicating a medium severity level.
Multer's diskStorage engine has a vulnerability where aborted multipart uploads can leave orphaned files on disk. This occurs in a brief window before the storage engine assigns the file path, allowing unauthenticated attackers to cause denial of service by exhausting disk space. The issue affects versions from 2.2.0 up to but not including 2.4.0. The vulnerability is a partial regression of a previous fix (CVE-2026-5038). No workarounds are available, but upgrading to version 2.4.0 or higher resolves the issue.
A denial of service (DoS) vulnerability exists in the Angular Server-Side Rendering (SSR) package @angular/platform-server due to a flaw in the domino HTML parser. When processing untrusted input containing an incomplete DOCTYPE declaration ending with whitespace before EOF, the parser enters an infinite synchronous loop that consumes 100% CPU and freezes the Node.js server process. This affects applications that bind untrusted user input to [innerHTML] or manipulate DOM on the server. The vulnerability is exploitable remotely without authentication. Workarounds include avoiding direct binding of untrusted input to [innerHTML] or sanitizing input to reject incomplete DOCTYPE strings. A patch is available for affected versions.
A vulnerability in Google Chrome prior to version 147.0.7727.55 involves insufficient validation of untrusted input in the Codecs component. This flaw could allow a remote attacker to cause out-of-bounds memory access by using a specially crafted video file. The issue has been assigned CVE-2026-13018 and is rated as medium severity with a CVSS score of 4.3. There are no known exploits in the wild and no explicit patch information provided in the input data.
A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: "[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch."
A vulnerability in deepseek-ai deepseek-harness up to version 0.1.5-rc.3 allows local attackers to manipulate the E2B_API_KEY argument, causing reliance on untrusted inputs in a security decision. The issue affects an unknown function in the file packages/e2b/e2b/src/index.ts of the dsh component. Exploit code is publicly available. The vendor has not responded to disclosure attempts. The vulnerability has a low severity score of 3.3 CVSS and requires local access for exploitation.
CVE-2026-101105 is a medium severity SQL injection vulnerability in code-projects Matrimonial System 1.0. It affects the processprofile_form function at the /create_profile endpoint, allowing remote attackers with low privileges to manipulate the fname argument to perform SQL injection. The vulnerability impacts confidentiality, integrity, and availability. Public exploit code is available. No patch or remediation information is provided.
CVE-2026-101203 is a medium severity vulnerability in FastStone Image Viewer up to version 8.3. It involves an out-of-bounds write in an unknown function of the 1bpp RLE Decoder component. The vulnerability can be triggered remotely and requires user interaction. No vendor response or patch is currently available.
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-102006 is a medium severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves improper release of allocated kernel memory in the process management subsystem when specific system call arguments are used, leading to memory not being freed after the calling application terminates. This issue has been fixed in version 26.09.
Multiple vulnerabilities in curl affecting various Ubuntu LTS and interim releases were addressed in update USN-8487-2. These include issues with connection reuse during STARTTLS upgrades, incorrect connection reuse for Negotiate authentication, improper cookie parsing, double-free leading to potential code execution, .netrc password selection errors, proxy authentication state leaks, use-after-free in event callbacks, early TLS data transmission without certificate verification, and SSH host key type mismatches. The update fixes an incomplete prior patch for CVE-2026-8927. These issues could allow remote attackers to cause denial of service, access sensitive information, or impersonate trusted servers.
RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...