The npm package @revizahoshii/hoshino-store-mongo contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious components, as the attacker may have established persistent control over the system.
The npm package '@revizahoshii/hoshino-store-mysql' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the potential for persistent malicious software, all secrets and keys stored on the compromised machine should be rotated from a different, secure device.
The npm package @revizahoshii/hoshino-store-redis contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys. Removal of the package does not guarantee elimination of all malicious components, as the attacker may have established persistent control.
CVE-2026-81856 is a low-severity vulnerability in hexpm hex versions from 0.0.1 up to but not including 2.5.2. It involves improper neutralization of escape, meta, or control sequences, allowing a malicious package publisher or hostile repository server to inject terminal control sequences into the output of Mix tasks. This can lead to forged terminal output, concealed real output, or clipboard writes without requiring authentication or privileged access.
CVE-2026-108901 is a medium severity vulnerability in Shenzhen HCC Technology MPOS M6 PLUS version 1.31-N. It involves improper restriction of rendered UI layers due to manipulation of the argument alignment in the Display QR Code Rendering component. The attack can only be performed from the local network. The vendor has not responded to disclosure, and no patch or remediation is currently documented.
The npm package @alipclutch/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected system should be rotated immediately from a secure, unaffected device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
CVE-2026-103060 is a path traversal vulnerability in erlang rebar3 affecting versions from 3.7.0-rc1 up to but not including 3.27.2. It allows a malicious package publisher to delete directories outside the intended _build directory and extract package files there when dependencies are fetched. This occurs because rebar3 uses an unvalidated app field from package dependencies to construct directory paths, which can be manipulated to traverse directories. The vulnerability was publicly disclosed on 2026-10-12.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw. This flaw allows a remote attacker with administrative privileges to access authentication materials of users with higher privileges. Exploitation could lead to unauthorized administrative access. The vulnerability is identified as CWE-269 (Improper Privilege Management) and has a high severity with a CVSS score of 8.4.
The npm package @fazzcodestudio/fbot contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized control and access to secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
The npm package @we3js/framework contains malicious code that can fully compromise any computer on which it is installed or run. The presence of this package indicates a severe security risk, as attackers may gain full control of the affected system. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised device is strongly advised. However, removal of the package alone may not eliminate all malicious components introduced by the compromise.
The npm package @fazzcodestudio/baileys contains malicious code that fully compromises any computer on which it is installed or running. This compromise potentially exposes all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removing the package alone may not eliminate all malicious software. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package @fazzcodestudio/wa-web, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically uses the installer's authenticated WhatsApp session to subscribe the account to WhatsApp Channels chosen by the publisher without user consent. This behavior is enabled by default and undocumented, requiring manual configuration to disable. The package does not exfiltrate credentials or maintain persistence, but it covertly inflates channel subscribers using the victim's account. Versions 0.3.0 and 0.3.1 are affected.
The npm package '@fazzcodestudio/mediaformater' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
CVE-2026-96612 is a path traversal vulnerability in hexpm hex affecting versions from 0.6.0 up to but not including 2.5.2. It allows a malicious package publisher to specify a crafted application label that causes the dependency management process to delete and overwrite directories outside the intended deps directory. This occurs because hex does not validate the app label properly and uses it directly to determine the directory path for unpacking packages. The vulnerability can lead to arbitrary directory deletion and file overwriting during dependency fetching or updating.
The npm package @badzz88/eslint-config contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected computer should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
Progress Software Corporation's MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, may log sensitive security information in diagnostic logs under certain configurations. This could allow an attacker with access to these logs to gain unauthorized access to protected resources. The vulnerability is identified as CWE-532, involving insertion of sensitive information into log files. It has a high severity with a CVSS score of 8.1.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an XQuery injection vulnerability in a deprecated Management API package path. This flaw allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control. The vulnerability is classified as improper privilege management (CWE-269) and has a critical severity with a CVSS score of 9.9.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw in forest-management operations. This flaw allows a remote attacker with forest-management privileges to create a persistent unauthorized administrator account, potentially gaining full administrative control of the server. The vulnerability is rated critical with a CVSS score of 9.9.
CVE-2026-9191 is a critical origin validation vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. This flaw could allow an attacker who can execute code via these paths to perform unauthorized actions or compromise authenticated sessions.