@modss/baileys is a maliciously modified fork of the Baileys WhatsApp Web library that automatically follows publisher-controlled WhatsApp channels at runtime. It fetches a remote list of newsletter IDs from a GitHub URL and issues follow commands on the user's authenticated WhatsApp session without user consent. This behavior is embedded in all published versions of the package. No credential or session key theft was observed, but the package grants an attacker control over the WhatsApp session's follow actions. The package should be considered fully compromised and removed immediately.
The company-sdk package version 0.0.1 on PyPI contains malicious code that executes upon import. It harvests sensitive credentials and configuration files from the user's home directory and environment variables, encrypts the collected data, and exfiltrates it to a private GitHub Gist using a hardcoded GitHub Personal Access Token. The exfiltration uses TLS with certificate verification disabled and runs silently even if errors occur.
Multiple denial of service vulnerabilities have been identified in various Go language packages used by the golang-github-openprinting-ipp-usb component, which provides an HTTP reverse proxy backed by IPP-over-USB connections for driverless USB device support. These vulnerabilities include issues in MIME header parsing, ASN.1 unmarshalling, URL path resolution, HTTP/2 unencrypted connections, TLS KeyUpdate message handling, and XML decoding recursion. Red Hat has issued an important security update for Red Hat Enterprise Linux 10 to address these issues.
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A new Mini Shai-Hulud worm variant named Trinitite was detected targeting the npm package @7nohe/openapi-react-query-codegen. The attacker exploited a GitHub workflow vulnerability allowing any user to trigger npm publish via pull-request comments, resulting in rapid publication of malicious package versions. The worm uses obfuscation techniques to execute even when scripts are disabled, steals credentials from multiple developer and cloud platforms, and exfiltrates data via GitHub commits. It establishes persistence through systemd services and includes a destructive token revoke mechanism that can wipe user directories. This campaign is linked to the TeamPCP threat actor and appeared shortly after arrests of related suspects in Australia.
Red Hat has issued a security update for osbuild-composer, a service used to build customized OS artifacts including VM images and OSTree commits. The update addresses multiple vulnerabilities in dependencies such as golang.org/x/net/html and github.com/labstack/echo, including cross-site scripting (XSS) flaws and an unauthorized information disclosure issue. These vulnerabilities could lead to arbitrary code execution or information leakage. The update is rated as having an Important security impact by Red Hat Product Security. The affected products include Red Hat Enterprise Linux 9.2 and related variants. Users are advised to apply the update as detailed in the Red Hat advisory.
An attacker exploited a flawed GitHub Actions workflow in the npm package @7nohe/openapi-react-query-codegen to publish 10 malicious versions. The vulnerability stemmed from an issue_comment trigger lacking author-association checks, allowing arbitrary users to trigger npm publishing from forked repositories. The malicious payload used multiple execution methods, including a binding.gyp file exploiting node-gyp's Python evaluation and a preinstall hook, ultimately delivering a large obfuscated script that downloaded Bun v1.4.0. This attack aligns with the Mini Shai-Hulud toolkit previously seen in other supply chain compromises. All malicious versions have been removed from npm.
CVE-2026-19410 is a critical time-of-check time-of-use (TOCTOU) race condition vulnerability in Google Cloud Build's GitHub Trigger Comment Control. It allows a remote attacker to execute unreviewed code in the build environment by exploiting webhook suppression. This vulnerability was patched by Google on June 24, 2026, and no customer action is required.
CVE-2026-82423 is a medium severity vulnerability in macrozheng mall up to version 1.0.3. It involves an unknown function in the /order/paySuccess endpoint of the Payment Status component. The vulnerability arises from manipulation of the orderId argument, which leads to enforcement of behavioral workflow. The attack can be performed remotely. The vendor has not provided a patch or remediation guidance and deleted the related GitHub issue without explanation.
CVE-2026-82364 is a race condition vulnerability in macrozheng mall versions 1.0.0 through 1.0.3 affecting the /order/submit component. The vulnerability can be triggered remotely but requires high attack complexity and is difficult to exploit. There is no official remediation or patch available, and the vendor has not provided further details or explanation after deleting the related GitHub issue. The CVSS 4.0 score rates this vulnerability as low severity.
This entry references a GitHub account hosting a collection of Python networking and cybersecurity projects. The content is a link post from a Reddit cybersecurity subreddit where the user shares their GitHub repository containing tools for host discovery, port scanning, TCP communication, banner grabbing, and service enumeration. There is no indication of a security vulnerability, exploit, or active threat associated with this repository or account.
An investigation into malware delivery infrastructure reveals an operator using GitHub repositories to stage malicious loaders and RAT payloads. Starting from commit metadata, researchers traced an email address to a compromised machine via stealer log databases. The infected workstation exposed a complete operational pipeline including multiple RAT families (AsyncRAT, DcRat, Remcos, XWorm), phishing templates impersonating Colombian government institutions, bulk email software, and commercial crypter services. The operator maintains delivery infrastructure across GitHub, Bitbucket, AWS S3, and DuckDNS for command-and-control. Phishing campaigns target Colombian organizations using judicial notification and traffic violation lures with password-protected archives. The investigation demonstrates how infrastructure analysis and operational security failures can expose entire malware production workflows beyond individual samples.
This update for broot fixes the following issues:
Changes in broot:
- v1.59.0 (CVE-2026-72847 boo#1275994)
* new shell_command verb attribute: run a command through a shell (sh -c / cmd /C) so &&, ; and pipes work, without leaving broot - Fix #1145
* fix invalid official Mac binary (duplicate linked dylib) with new build chain - Fix #1194
* Sixel graphics support for image preview, auto-detected: works in iterm2, Windows Terminal 1.22+ and Sixel-capable Unix terminals (foot, mlterm, xterm built with Sixel, recent WezTerm). Kitty remains the preferred protocol when available. Note: this requires broot to be compiled with sixel feature (eg cargo install broot --features sixel) - Fix #568
* High-Res images in Rio terminal (detect it to enable the Kitty image protocol) - Fix #1179
* fix iTerm2 3.6.10 and later not displaying Hi-Res images, the version being compared as text
* fix content-exact match line number off-by-one when the match starts at the first byte of a line (broot jumped to the line above)
* new :no_action internal, doing nothing, which can be used to disable a key - Fix #328
* fix: detect a duplicate broot server name instead of silently overtaking the running server - Fix #1065
* fix preview transformers extension matching not working with double extensions such as .tar.gz - Fix #1195
* strip escape sequences from displayed names to prevent OSC injections - Fix #1188
* fall back to numeric uid/gid instead of ???? when the user or group name can't be resolved, which is always the case on statically linked musl builds - Fix #1075
* fix panic on a content regex matching the empty string at the end of a line ending with a control char (eg cr/$/ on a CRLF file)
* fix Windows paths (containing backslashes) being mangled by the launcher's eval when using :cd and similar; also fixes escaping of paths containing a single quote - Fix #1100
* fix br failing on Windows/PowerShell when the temp path contains a space (e.g. a space in the Windows username) - Fix #788
* JPEG XL images are no longer previewed: the decoder had out-of-bounds bugs and the fix needs a more recent rustc (if you need it, tell me and I'll try to make it opt-in)
* rustc minimal version changed from 1.83 to 1.85, and edition 2024
- v1.58.0
* change the way possible verb completions are listed, making it more readable when there are more than what fits the screen
* fix argument of :select and :show being ignored in a --cmd sequence - Fix 1176
- v1.57.0
* help: verb 'keys' and 'description' columns now searchable - Fix #1163
* fix :print_path / :print_relative_path adding a trailing empty line when printing a multi-item staging area - Fix #1062
* Skin: attributes (bold, underlined, etc.) of the "selected_line" entry now applied - Fix #1156
* if no Wezterm version is found, broot now assumes it's recent enough to support kitty protocol for image - Fix #509
- v1.56.4
* fix compilation on non unix platforms (1.56.3 isn't available on those systems)
- v1.56.3
* fix control characters sometimes remaining in the terminal after broot exit
* nushell: rename br module to avoid conflict in last nushell version - Fix #1138
* :open_stay on the staging area opens every staged file through the system opener - Fix #444
- v1.56.2
* {file-root-relative} argument - Fix #1142
* fix :clear_stage (or other operations closing the stage panel) often closing broot - Fix #1143
- v1.56.1
* fix a typo in a verb in default conf
- v1.56.0
* impacted_panel verb argument, allows the effect of a verb to be on another panel (eg to scroll the preview panel without removing the focus from the tree) - Fix #1119
* focus_panel_left and focus_panel_right internals - Fix #1115
* Major Feature: merge staged files to issue a single command: when a verb argument has a space-separated or comma-separated flag, a single external command is run even when the selection is multiple - Fix #465 The default verbs.json file has an example of a zip verb building an archive from all staged files.
- v1.55.0
* activate Kitty Graphics Protocol to display Hi-Res images in iTerm2
* Tokyo Night skin ( https://github.com/Canop/broot/blob/main/resources/default-conf/skins/tokyo-night.hjson )
* matches related to several name patterns joined with and/or in a composite pattern are merged instead of having just the first one shown
* nushell integration: switch $nu.temp-path to $nu.temp-dir - #1116
- v1.54.0
* fix crash on rendering B&W images with Kitty image protocol
* don't match directories when a composite pattern has a content pattern, even negated (eg /js$/&!c/;: it's clear the user wants to match js files not containing a semicolon)
- v1.53.0
* fix some cases of the verb not removed from the input on execution (with a risk of accidental double execution)
* add the :filesystems (short :fs) verb and state on windows (it was already present on linux and mac).
* improve the generation of preview pattern from
The eip712-lite npm package versions 1.0.1 and 1.0.2 contain malicious code that executes upon requiring the package. This code collects sensitive credential files and environment variables from the user's system, compresses and encodes the data, and exfiltrates it to a GitHub repository using a hardcoded and obfuscated bearer token. After exfiltration, the malicious payload in the package file is overwritten to hide its presence. The package falsely advertises itself as a dependency-free EIP-712 helper. Execution is designed to evade detection by running only once per machine and skipping execution in CI or GitHub Actions environments. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately from a different machine.
JS Recon versions from 1.2.1-beta.1 up to but not including 1.3.1-beta.2 contain an OS command injection vulnerability in the PR Branch Checker GitHub Actions workflow. This flaw allows a remote attacker who opens a pull request to inject shell commands via specially crafted branch or fork names. The injected commands execute with the workflow's GITHUB_TOKEN permissions, which include write access to pull requests. The vulnerability is fixed starting with version 1.3.1-beta.2.
In July 2026, multiple APT campaigns targeted South Korean entities using spear phishing emails with malicious LNK files. Seven distinct attack types employed various techniques such as PowerShell scripts, AutoIt programs, DLL side-loading, and curl.exe downloads. Malware was distributed via platforms like GitHub, Google Drive, and Dropbox, disguised as legitimate documents or resumes. The campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate sensitive information and maintain persistence through Task Scheduler entries. Communication with command and control servers used PubNub channels with Base64-encoded data. The attacks focused on deceiving victims with work-related content to execute malicious payloads.
CVE-2026-81100 is a high-severity vulnerability in the timescale tiger-gh-mcp-server where the MCP HTTP transport did not enable host allow-listing, allowing it to accept requests with arbitrary host headers. This flaw stems from the httpServerFactory helper not setting the DNS-rebinding-protection option, enabling potential control of the locally reachable GitHub MCP endpoint via a maliciously crafted host name. The issue was fixed by explicitly passing the protection option alongside a dependency update. No official release includes this fix, so only the commit preceding the fix is affected.
