---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cf0e5e4aa66ffeb1481fd587c96f596a227c9388b86b3a3443749b5ec9eb09f1)
The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the installer. It enumerates npm credentials by calling `npm config get` for keys including `_authToken`, `_auth`, `registry`, `//registry.spectral-corsair.htb:1337/:_authToken`, `//registry.spectral-corsair.htb/:_authToken`, and `//154.57.164.64:32271/:_authToken`, dumps the full `npm config list --json`, and reads /usr/lib/node_modules/npm/.npmrc, /etc/hosts, /app/.bowerrc, /root/.bowerrc, and source files under /app (Cargo.toml, main.rs) plus filesystem-wide flag/secret greps. The collected output is base64-encoded and HTTP PUT to a hardcoded bare IP `http://154.57.164.64:32271/api/modules/...`. Separately, postinstall.js appends `154.57.164.64 registry.spectral-corsair.htb` to /etc/hosts when not already present, then queries the spoofed registry via curl and `npm view` — install-time host-file tampering that redirects a registry hostname to an attacker-controlled IP and enables later package substitution / MITM. Execution is gated by an anti-analysis `shouldRun()` that bypasses CI environments (GITHUB_ACTIONS, RUNNER_OS, CI), Chinese registry mirrors (npmmirror, tencent, cnpm, taobao), and /tmp working dirs, and only fires when the hostname matches a 12-hex Docker short-id pattern and cwd contains `/app` — narrow targeting that confirms intent while shipping the malicious code unconditionally.
## Source: ghsa-malware (38185d2c242e73e720a6be3f2b234a23119ec986c4b7ca57ca789e24616c1029)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (f10fa9dc8c51419efaef960da0e4bed5e80346be9279a40d610d695a8571f6b7)
The OpenSSF Package Analysis project identified 'coral-wraith' @ 6.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
A sophisticated smishing and phishing operation active since the second half of 2025 has impersonated over 267 brands across 72 countries, with particular concentration in Latin America. The campaign generated 4,389 phishing domain instances, with Mexico accounting for 1,851 cases. Telecommunications is the most targeted sector with 1,754 instances, followed by financial services and consumer rewards programs. The operation employs fake Cloudflare error pages as decoys, revealing malicious content only to victims matching specific geofencing and mobile device criteria. Data exfiltration occurs through encrypted WebSocket channels using binary encoded payloads. Approximately 30% of infrastructure is hosted on Tencent Cloud and Alibaba US servers, fronted by Cloudflare to mask hosting IPs. The attack chain progresses from SMS lures through progressive credential harvesting, ultimately capturing complete credit card details including CVV codes.
A coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus has been exposed, originating from fraudulent SMS messages impersonating Romania's government payment portal Ghișeul.ro. Investigation revealed 1,628 malicious URLs linked by a single 128-character campaign identifier, targeting government portals, traffic police departments, postal services including DPD and SEUR, tax authorities, and telecommunications providers like T-Mobile and Vodafone. The infrastructure utilizes 32 backend IP addresses distributed across Tencent Cloud, Alibaba Cloud, Cloudflare CDN, and ALEXHOST Moldova. Threat actors employ two distinct phishing templates: a Vue.js single-page application and a Bootstrap-based clone, executing a four-stage credential harvesting process that collects complete payment card details through fabricated traffic fines, toll payments, and delivery notifications.
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
### Impact
A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted `Authorization` header to any LLM API route (for example `POST /chat/completions`) and reach this query through the proxy's error-handling path.
An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.
### Patches
Fixed in **`1.83.7`**. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to `1.83.7` or later.
### Workarounds
If upgrading is not immediately possible, set `disable_error_logs: true` under `general_settings`. This removes the path through which unauthenticated input reaches the vulnerable query.
### References
- Patched release: [`v1.83.7-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)
**Discovery Credit**: Tencent YunDing Security Lab
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).
If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.
To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems.
This vulnerability is fixed in versions:
1.15.x: 1.15.2 and above.
1.16.x: 1.16.1 and above.
1.17.x: 1.17.0 and above (i.e. all versions).
Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.tencent-cloud-cls log export uses plaintext HTTP
This issue affects Apache APISIX: from 2.99.0 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
CVE-2026-5585 is an information disclosure vulnerability in Tencent AI-Infra-Guard version 4.0. It involves an unknown function in the Task Detail Endpoint component, specifically in the file common/websocket/task_manager.go. The vulnerability can be exploited remotely without authentication and may lead to partial information disclosure. The exploit code has been publicly disclosed. The vendor has not provided any response or patch information as of the publication date. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By smuggling dangerous PostgreSQL functions inside these expressions and chaining them with large object operations and library loading capabilities, an unauthenticated attacker can achieve arbitrary code execution on the database server with database user privileges. This issue has been patched in version 0.2.12.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, the application's "Import document via URL" feature is vulnerable to Server-Side Request Forgery (SSRF) through HTTP redirects. While the backend implements comprehensive URL validation (blocking private IPs, loopback addresses, reserved hostnames, and cloud metadata endpoints), it fails to validate redirect targets. An attacker can bypass all protections by using a redirect chain, forcing the server to access internal services. Additionally, Docker-specific internal addresses like host.docker.internal are not blocked. This issue has been patched in version 0.2.12.
VoidLink is a Linux C2 framework that generates implant binaries for cloud and enterprise environments. The implant, likely built using an LLM coding agent, demonstrates advanced capabilities including multi-cloud targeting, container awareness, and kernel-level stealth. It fingerprints cloud environments across AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud, harvesting credentials and detecting container runtimes. The malware includes plugins for container escape and Kubernetes privilege escalation, as well as a kernel-level rootkit that adapts its approach based on the host's kernel version. C2 communications use AES-256-GCM over HTTPS, disguised as normal web traffic. VoidLink highlights the growing concern of LLM-generated implants reducing the skill barrier for producing sophisticated malware.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows users to call the database query tool. Due to insufficient backend validation, an attacker can use prompt‑based bypass techniques to evade query restrictions and obtain sensitive information from the target server and database. This issue has been patched in version 0.2.5.
CVE-2025-13715 is a high-severity remote code execution vulnerability in Tencent FaceDetection-DSFD's resnet endpoint caused by deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The flaw allows attackers to execute arbitrary code with root privileges due to improper validation of user-supplied data. Although no known exploits are currently in the wild, the vulnerability poses significant risks to affected systems. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction. European organizations using Tencent FaceDetection-DSFD should prioritize patching and implement strict input validation and network segmentation to mitigate risks. Countries with significant technology sectors and Tencent product usage, such as Germany, France, and the UK, are likely to be most affected. Immediate attention is warranted to prevent potential exploitation in sensitive environments.
CVE-2025-13709 is a high-severity remote code execution vulnerability in Tencent TFace's restore_checkpoint function caused by deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file. The flaw allows attackers to execute arbitrary code with root privileges due to improper validation of user-supplied data. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to affected systems. The CVSS score is 7.8, reflecting high impact on confidentiality, integrity, and availability. European organizations using Tencent TFace, especially in sectors relying on AI and facial recognition technologies, should prioritize patching and implement strict input validation and network segmentation. Countries with strong technology sectors and high adoption of Tencent products, such as Germany, France, and the UK, are most likely to be affected. Immediate mitigation and monitoring are recommended to prevent potential exploitation.
A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. It is advisable to upgrade the affected component. The vendor responds: "We have confirmed that the issue mentioned in the report does not exist in the latest releases".
