A vulnerability in the Linux kernel's nfsd_direct_write function causes incorrect detection of partial writes. The function fails to properly detect short writes between 50% and 99% of a segment, leading to writing data at incorrect file offsets and over-reporting write counts to NFS clients. This issue has been resolved in specific Linux kernel versions.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1)
The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands (whoami, ipconfig/ip addr, directory listings of C:\ and /, tasklist/ps, and a full environment-variable dump via set/env) and POSTs the collected output over plain HTTP to a hardcoded remote server at 209.126.81.147, using path segments under a canary token 'etoro-nuget-verify1f8eaa57a875'. The package name 'etoro-cashout' at version 99.0.2, the eToro-branded canary, and the beacon path shape are consistent with a dependency-confusion probe targeting an internal eToro registry: any build environment that resolves this public name executes the exfiltration on install. Data leaving the installer includes hostname, username, working directory, filesystem listings, running processes, and the full process environment, which on CI systems routinely contains cloud credentials, registry tokens, and API keys.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad)
The package's preinstall.js lifecycle script executes automatically on `npm install` and performs reconnaissance on the installer host. It collects hostname, username, current working directory, platform, and the output of OS commands including `whoami /all`, `ipconfig /all` / `ifconfig`, `tasklist` / `ps aux`, directory listings of `/`, `C:\`, and the user's home, and a dump of environment variables. The collected data is transmitted via HTTP GET and POST to the hardcoded bare IP endpoint `http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/v4/...`. The package's declared main is an empty stub and its description ("Internal service client library") combined with the implausibly high version number `99.0.2` is consistent with a dependency-confusion attack targeting an internal `etoro-aggregator` name. The manifest plus the preinstall script constitute the entire payload; installing the package leaks installer host identity, network configuration, filesystem structure, and environment variables (which routinely contain credentials and tokens) to an attacker-controlled endpoint.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92)
etoro-analytics@99.0.2 ships a preinstall lifecycle script (preinstall.js) that automatically runs on `npm install`. The script collects installer host identifiers (hostname, username, cwd, platform) and issues an initial HTTP GET to http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/v4/<host>/<user>/<platform>/<cwd>. It then invokes child_process.execSync on platform-branched reconnaissance commands (`whoami /all`, `ipconfig /all`, `tasklist` on Windows; `whoami`, `ifconfig`, `ps aux`, `env` on POSIX) plus home/root directory listings and POSTs the output back to the same hardcoded bare-IP endpoint over plain HTTP. The package name, implausibly high version number (99.0.2), and canary-token URL path are consistent with a dependency-confusion beacon targeting an internal etoro package namespace.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a)
On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET to http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<host>/<user>/<platform>/<cwd>, then executes `whoami; id; hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same hardcoded bare-IP endpoint over plain HTTP. The package.json advertises the package as an `Internal service client library` at version 99.0.0 with no real functional code beyond the preinstall hook, and the beacon path segment `etoro-nuget-verify...` targets an internal eToro namespace, matching the dependency-confusion recon pattern.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c)
The package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.
cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code (index.js is an 87-byte stub), and package.json declares both preinstall and postinstall running `node scripts/run.js`, so the payload executes twice during npm install before any application code. The script resolves a DNS canary and POSTs to a webhook.site collector; 99.1.0 additionally sends os.userInfo().username and os.hostname(). The author labels this a PoC, but the beacon fires on any install that resolves the package and exfiltrates a username usable for follow-on attacks, and dependency-confusion packages require incident response even when trivial.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ad357542f3dd0e1b598ef36d440b1868ac28c6889226864bf799b2f7b6bf5e91)
Package cat-sis2go-utils@99.0.0 declares both preinstall and postinstall lifecycle hooks in package.json that execute scripts/run.js on every npm install. The script unconditionally issues a DNS lookup against d22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site and POSTs a JSON beacon containing the installer's hostname and process context to https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7. The package description self-identifies as a dependency-confusion PoC, and the 99.0.0 version is consistent with a resolution-winning squat targeting an internal package name. Installing the package results in arbitrary code execution on the installer host and fingerprints the machine to third-party out-of-band collectors under the operator's control.
The olympuslib package on PyPI version 99.99.0 contains malicious code that exfiltrates environment variables and system information to an external host upon import. This includes sensitive data such as CI tokens, cloud credentials, API keys, and database URLs. The package appears to be part of a dependency confusion attack targeting private or internal package names by masquerading with an inflated version number. There is no known exploit in the wild, and no patch or remediation guidance is currently available.
The pymaas package on PyPI, version 99.99.0, contains malicious code that executes upon import. It collects all environment variables and the hostname, serializes this data as JSON, and sends it to a hardcoded external URL without user consent. This behavior is indicative of a dependency confusion attack designed to exfiltrate sensitive credentials such as CI tokens, cloud keys, and passwords from the environment.
The PyPI package tpu-raiden-jax version 99.99.0 contains malicious code that exfiltrates environment variables and system information upon import. It sends the entire environment variables dictionary along with the hostname to a suspicious external URL unrelated to any legitimate publisher. This behavior is consistent with a dependency confusion attack aiming to steal secrets such as AWS credentials, GitHub tokens, and other sensitive environment variables. No official patch or remediation is currently documented.
The npm package 'fieldbase-webapplication-buildtools' version 99.99.99 contains malicious code that executes automatically during installation. It collects sensitive environment information such as the installer's username, hostname, current working directory, and package name, encodes this data, and sends it to a hardcoded external endpoint via HTTPS and DNS queries. This behavior is consistent with a dependency confusion attack targeting internal package names.
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.
The npm package quartz-core version 99.1.9 contains malicious code that executes during installation. Its preinstall script collects the installer's OS username, hostname, and current working directory, then sends this information via a DNS query to an attacker-controlled domain. This behavior is consistent with reconnaissance for dependency confusion attacks. The package has no legitimate functionality beyond this beacon. Systems with this package installed should be considered fully compromised.
The npm package 'autobahn-electron-probe' version 99.99.1 has been identified as malicious by the OpenSSF Package Analysis project. It is considered malicious because it executes one or more commands associated with malicious behavior. There is no CVSS score or detailed technical exploit information available. No patch or remediation guidance is provided. No known exploits in the wild have been reported.
A reflected cross-site scripting (XSS) vulnerability exists in the All Video Share extension for Joomla by mrvinoth.com. Versions 1.0.0 through 4.4.99 do not properly escape various user-supplied inputs, allowing injection of malicious scripts that are reflected back to users. This vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-81524 is a medium severity vulnerability in the MongoDB C Driver where improper sanitization of database and collection name components allows operations to be directed at unintended resources. This occurs when untrusted input is incorporated into these name components, leading to potential resource injection.
CVE-2026-81521 is a high-severity vulnerability in the MongoDB Go Driver affecting the Client.BulkWrite API. It arises from improper control of resource identifiers, where a caller-supplied database name containing a reserved separator character is not escaped before use. This flaw allows an application passing untrusted input as a database name to have writes directed to unintended databases and collections.
The npm package 'rn-push-provisioning' versions 99.0.0 and 99.0.1 contains malicious code that executes during installation. It runs a preinstall script that collects host and user information and sends it to a third-party endpoint unrelated to the legitimate publisher. This behavior constitutes install-time exfiltration of identifying information. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package alone may not fully remediate the compromise due to potential additional malicious software.
CVE-2026-59275 is a deserialization vulnerability in Spring AMQP that allows a single malicious AMQP message to cause the entire consumer JVM to terminate via System.exit(99), resulting in complete availability loss for all workloads running in that process. It affects multiple versions of Spring AMQP, including 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data).
The npm package 'array-shuffler-utils-99' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.