The @mikudeveloper/baileys npm package version 1.0.0 contains malicious code that executes unauthorized actions during installation and runtime. It depends on an unverified git repository for a critical library, allowing the repository owner to execute arbitrary code on any system installing the package. Additionally, it silently subscribes the user's WhatsApp session to channels controlled by the attacker by fetching a mutable remote list, without user disclosure.
The @sanzoffc/baileys npm package is a malicious fork of the Baileys WhatsApp library that performs covert remote-controlled actions using the installer's authenticated WhatsApp session. It fetches a JSON list from a third-party controlled GitHub branch and issues WhatsApp GraphQL mutations to subscribe or follow newsletter IDs without user consent. The package uses obfuscated strings and hardcoded identifiers to evade detection. This behavior is undocumented and non-configurable, indicating malicious intent. The package pins most dependencies loosely, increasing risk. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.
The @lekzo/baileys npm package versions 0.0.1 and 0.0.7 declare a dependency on libsignal via a bare GitHub repository reference without a fixed commit, tag, or version. This allows the dependency to resolve to the current HEAD of that repository at install time, enabling arbitrary code execution from whoever controls that repository. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
This security update for kronosnet addresses three vulnerabilities: improper sanitization of sensitive memory that could expose encryption keys, improper verification of packet origins allowing ACL bypass via ID spoofing, and improper validation during fragment reassembly that may cause memory corruption or out-of-bounds access. These issues could lead to unauthorized access or memory safety problems. The severity is assessed as medium based on the described impacts. No affected versions or patch details are provided in the input data.
@nexustechpro/baileys version 2.2.7 is a maliciously modified fork of the WhatsApp library 'baileys' containing heavily obfuscated code in a core module that handles sensitive WhatsApp session state. It includes a floating dependency on 'whatsapp-rust-bridge' with no version pinning or integrity checks, allowing arbitrary code execution. Installation or use of this package compromises the host system, risking exposure of all stored secrets and keys.
This security update for libzypp and zypper addresses a security issue related to the handling of legacy unsigned repository cache states, enforcing strict signature verification when the repo_gpgcheck setting is enabled. Additional non-security fixes improve configuration parsing, credential handling, and solver problem logging. The update enhances the security posture by preventing acceptance of unsigned repository metadata once strict checking is enabled.
Multiple security vulnerabilities have been addressed in the multipath-tools package by SUSE, including heap out-of-bounds reads, path traversal, heap buffer overflows, and denial of service conditions. These issues affect various components such as the custom format string parser, device-mapper-multipath management, SCSI PRIN READ FULL STATUS responses, IPC send operations, GPT header validation, and multipathd socket handling. The update to version 0.12.4+278+suse.9cf9c5c includes fixes for these vulnerabilities and adds a missing NULL check in the DM parser.
@modss/baileys is a maliciously modified fork of the Baileys WhatsApp Web library that automatically follows publisher-controlled WhatsApp channels at runtime. It fetches a remote list of newsletter IDs from a GitHub URL and issues follow commands on the user's authenticated WhatsApp session without user consent. This behavior is embedded in all published versions of the package. No credential or session key theft was observed, but the package grants an attacker control over the WhatsApp session's follow actions. The package should be considered fully compromised and removed immediately.
A security update for libgpg-error addresses an out-of-bounds read vulnerability in the _gpgrt_vfnameconcat function within stringutils.c when the GPGRT_FCONCAT_SYSCONF flag is used. This issue could potentially lead to memory safety problems. The vulnerability is rated medium severity. No specific affected versions or CVSS score are provided.
This security update for libarchive addresses multiple vulnerabilities including buffer overruns, NULL pointer dereferences, segmentation faults, memory leaks, and file descriptor leaks. These issues affect various components such as temporary file creation, 7zip header processing, ELF header validation, RAR5 filters, and mtree parser cleanup. The update fixes these defects to improve stability and security.
Red Hat Ansible Automation Platform 2.1 includes updated Ansible plug-ins for the Red Hat Developer Hub that enhance automation and provide curated content. A security advisory published by Red Hat identifies multiple vulnerabilities including CVE-2026-47686 affecting this platform. The advisory highlights new features, bug fixes, and enhancements but does not specify any fixes or remediation guidance for the listed vulnerabilities. The severity of the vulnerabilities is rated critical. No known exploits in the wild have been reported, and no patch or official fix is currently available.
A security update for libpng16 has been released, updating the library to version 1.6.58. The update addresses multiple issues as noted in the upstream changes. No specific vulnerabilities or technical details are provided in the available information.
A security update for OpenSSL 3 addresses a denial-of-service (DoS) vulnerability identified as 'HollowByte' that involves attacker-controlled memory allocation. This vulnerability could allow an attacker to cause a DoS condition by manipulating memory allocation within OpenSSL. The update fixes this issue to improve the security and stability of the OpenSSL library.
A security update for cryptsetup addresses an issue where volume keys could be undesirably pinned via the caller's credentials due to a kernel refactoring. This caused the caller's thread keyring to remain alive longer than intended when the kernel opens a file, potentially impacting key management. The update introduces a new keyring key type, uses unique intermediary keyrings per device, and includes regression tests to prevent recurrence.
A security update for the sg3_utils package addresses issues related to SCSI inquiry export output conformance and quoting in a rescan script. The update fixes the sg_inq tool's --export output to conform correctly for SCSI name strings and ATA fields, and corrects quoting of $id_serial in the rescan-scsi-bus.sh script's findmultipath call.
This security update for rpcbind addresses multiple issues including a stack buffer overflow in rpcinfo's rpcbaddrlist(), unauthenticated oversized allocation in PMAPPROC_CALLIT decode, and several memory leaks. Additional improvements include hardening options in systemd service files and configuration relocations. The update corresponds to rpcbind version 1.2.9.
This security update introduces initial livepatches for the SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernels. Livepatching allows applying kernel patches without rebooting, improving system uptime and security. The update addresses vulnerabilities in these kernel versions to enhance system security.
This update for shim addresses multiple issues including a fix for CVE-2024-2312 related to SBAT metadata for grub.peimage. The update includes various bug fixes, improvements to network boot, loader protocol enhancements, and security improvements such as Authenticode generation and NX policy enforcement. No specific exploit details or active exploitation are reported.
This security update introduces initial livepatches for the kernel of SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2. The update addresses vulnerabilities in the kernel via livepatch technology, allowing patching without rebooting. No specific details about the vulnerabilities or affected kernel versions are provided.