The npm package @dikaaofficial/eslint-config contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @dikaaofficial/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software or control established by the attacker.
The npm package yonzofficial (versions 2.1.0 through 2.1.3) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 stores sensitive Wi-Fi credentials in cleartext within the wpa_supplicant.conf file. These credentials are further exposed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated access to the Android Debug Bridge (ADB) allows retrieval of the /etc/shadow file, which contains password hashes. This vulnerability leads to exposure of sensitive information due to insecure storage and access controls.
The npm package @chatbridgeworld/baileys contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the severity of the compromise, complete remediation may require rotating all secrets and keys from a separate, secure machine.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 has an insecure firmware update mechanism. The STM32 motor-controller firmware is downloaded over unencrypted HTTP, and integrity is only checked using MD5 with the hash provided in the same unprotected response. There is no code-signing implemented, which allows an attacker to replace the firmware with malicious code.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 exposes several local interfaces without authentication, including an HTTP REST API, ADB root shell access, and SSH. These unauthenticated interfaces allow access to critical functions such as motor control, telemetry data, WiFi credentials, and diagnostic exports.
FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains an unauthenticated remote code execution vulnerability via MQTT. The firmware accepts arbitrary shell commands through AWS IoT MQTT messages and executes them as root. Access control relies solely on shared IoT credentials without per-device authentication, allowing potential remote root code execution across devices.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains multiple hard-coded credentials embedded directly in its binary. These include fleet-wide BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are accessible through static analysis of the publicly downloadable firmware without requiring special privileges. A patch is available to address this issue.
CVE-2026-114594 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Sandisk Dashboard installer up to version 5.2.2.3. It allows a local, authenticated standard user to replace a binary in a user-writable temporary directory between validation and execution. This leads to execution of an attacker-controlled binary with elevated privileges, resulting in local privilege escalation to administrative level.
This report summarizes multiple cyber threats and vulnerabilities discovered in early November 2026, including ransomware attacks, supply-chain compromises, AI-powered exploitation frameworks, and several high-severity software vulnerabilities. Notable incidents include a ransomware attack on Queens Public Library, a destructive attack on Russian web hosting provider Beget, and a supply-chain attack on the Linux security tool cPGuard. AI-assisted threat actors targeted financial and cryptocurrency sectors, while multiple critical vulnerabilities were patched in SonicWall, Android, Barracuda Email Security Gateway, and OpenSSH. Some vulnerabilities have been linked to active exploitation.
The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.
Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries.
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
CVE-2026-118492 is a cross-site scripting (XSS) vulnerability in Eclipse Langium versions 3.0.0 through 4.4.0. The langium-sprotty package fails to HTML-escape diagnostic messages before rendering them in hover popups. This allows attacker-controlled JavaScript to execute in the browser or webview when a malicious source file triggers an unresolved cross-reference error with embedded HTML markup.
The gpa-core npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee full remediation due to potential persistent malicious software.
The @velliajs/telegram npm package contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
The npm package 'zhg.sql' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The npm package winks.tunnelsql contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.