The npm package 'dransay' version 99.0.0 contains a malicious preinstall script that performs network requests to a third-party collaborator domain during installation. This behavior leaks the installer's IP address, DNS resolver IP, hostname data, and timestamp to an external server. The package appears to be a dependency-confusion proof-of-concept but executes non-consensual outbound network communication.
The npm package '@dransay/address-validation' version 99.0.0 contains a preinstall script that performs a DNS lookup and HTTPS GET request to a known malicious collaborator domain during installation. This behavior is consistent with a dependency confusion probe designed to reveal the installer's IP address and package name to an external operator. No sensitive environment data or filesystem contents are accessed, and no additional code is fetched or executed. The package is flagged as malicious due to its communication with a domain associated with malicious activity.
The npm package @bellaxchuu/belbails version 1.0.1 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This subscription uses the victim's authenticated WhatsApp session without their consent. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The @lendxntaa/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription into the WhatsApp socket layer using the victim's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code. The targeted channels are obfuscated or dynamically fetched to avoid detection.
The npm package kiyoramarkets version 8.0.16 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channel identifiers are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package css-reading-display-polyfill, version 1.0.0, contains malicious code that executes system commands to collect sensitive host information and environment variables, then exfiltrates this data to a hardcoded external webhook. The package masquerades as a CSS polyfill but instead acts as a dependency confusion probe targeting Wix build infrastructure, potentially leaking CI secrets and cloud credentials.
The npm package 'tensorlake' version 0.5.144 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker full control, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised system is strongly advised.
The Cloudflare Access auth provider module for Backstage versions 0.1.0 up to but not including 0.5.0 does not verify that tokens presented for authentication were issued specifically for the Backstage application. This allows a user with a valid token for another Cloudflare Access application in the same Zero Trust team to authenticate to Backstage if the token reaches the auth endpoint without prior audience enforcement. The vulnerability depends on deployment configurations that allow direct or alternate access to the auth endpoint, bypassing normal Cloudflare Access protections. The impact depends on the permissions assigned to the authenticated identity. A fix is available in version 0.5.0 and later, which requires configuration changes to specify the correct audience.
An authenticated attacker with control over a TechDocs source repository in the Backstage plugin techdocs node can cause a documentation build to retrieve and publish data from network locations accessible by the build environment. The exposure depends on deployment topology, build mode, and endpoint protections. The vulnerability is addressed by upgrading to patched versions that remove MkDocs plugins outside a built-in allowlist. Additional mitigations include restricting repository control and limiting network access during builds.
CVE-2026-106456 is a medium-severity vulnerability in the @backstage/plugin-proxy-backend that allows unauthenticated access to nested proxy routes when overlapping proxy paths have inconsistent credential enforcement. Specifically, if a parent proxy path permits unauthenticated access and a nested path requires credentials, the parent exemption may allow unauthenticated requests to reach the nested upstream service. This can lead to confidentiality and integrity impacts depending on the nested upstream capabilities. The issue affects versions >=0.5.0 and <0.6.18 and is fixed in version 0.6.18 and later.
An inconsistency in repository filtering in the Bitbucket Server catalog event updates of the Backstage plugin allows authenticated users with push access to filtered-out repositories to trigger events that cause these repositories to be ingested into the catalog. This occurs despite configured filters meant to exclude such repositories, potentially leading to unintended trust and ingestion of repository metadata. The issue affects deployments using event-driven updates with readable filtered-out repositories. A fix is available in version 0.5.15 of the plugin.
An improper input validation vulnerability in the Backstage plugin '@backstage/plugin-scaffolder-backend-module-sentry' allows an authenticated internal user with permission to execute certain actions to cause the backend to contact unintended destinations and disclose Sentry integration credentials. This can lead to credential exposure depending on network reachability and token privileges. The issue is fixed in version 0.3.8 and later.
A vulnerability in @backstage/plugin-auth-node affects shared OAuth profile normalization used by several Passport-based authentication providers. The flaw allows an explicitly unverified email address to be passed to email-based sign-in resolvers, potentially enabling an attacker to assume another catalog identity and gain its access and permissions. The issue is fixed in versions 0.6.15 and 0.7.5. Mitigations include requiring verified emails from identity providers or using sign-in resolvers that do not rely on profile emails.
A remote code execution vulnerability exists in the @backstage/plugin-techdocs-node component due to crafted markdown_extensions in the TechDocs mkdocs.yml file. An authenticated user with permission to register catalog entities can exploit this flaw to execute arbitrary OS commands on the TechDocs build host during documentation builds. The issue is patched in version 1.15.4. Workarounds include switching to an external builder mode, restricting catalog entity registration permissions, and auditing existing mkdocs.yml files for suspicious markdown_extensions entries.
A vulnerability in the @backstage/plugin-techdocs-node package allows an attacker who can supply configuration to a TechDocs build to execute code in the generator runtime. This risk is especially severe if the documentation generation process runs with backend credentials or has host access. The issue is fixed in version 1.15.4. Until patched, it is recommended to generate TechDocs externally in isolated environments without sensitive credentials and to restrict and review configuration changes before generation.
An input validation vulnerability in the Confluence to Markdown scaffolder module of Backstage allows an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template processing attacker-controlled Confluence content. The issue is patched in version 0.3.25 of the plugin.
CVE-2026-106560 is a high-severity vulnerability in the Backstage plugin '@backstage/plugin-scaffolder-backend-module-confluence-to-markdown'. It allows an authenticated user who can execute an affected template and control the repository file location to write generated content outside the intended task workspace, potentially overwriting files in locations writable by the backend process. This improper repository path validation can lead to integrity impact. The issue is patched in version 0.3.25 of the plugin.
An authorization bypass vulnerability exists in the Backstage plugin search backend when permission filtering is enabled and using Elasticsearch or OpenSearch. Authenticated users subject to a DENY policy for certain search document types may receive unauthorized search results. This affects versions of @backstage/plugin-search-backend prior to 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch prior to 1.8.7. A fix is available in these versions.
An improper entity validation vulnerability exists in the deprecated Kubernetes services endpoint of the @backstage/plugin-kubernetes-backend. Authenticated users with Kubernetes read permissions can exploit this flaw to access Kubernetes workload metadata beyond their intended scope. The exposure is limited to read-only access of Kubernetes object metadata across configured clusters. The issue is patched in version 0.21.8 of the plugin. Workarounds include disabling the deprecated endpoint or restricting read permissions.
An information disclosure vulnerability exists in the @backstage/plugin-kubernetes-backend prior to version 0.21.9. Authenticated users with Kubernetes resource read permissions could access sensitive data that the plugin is intended to mask, including credentials and confidential information from connected clusters. Exposure is limited to resources accessible by the Backstage service account and matching the targeted namespace and label selectors. The issue is fixed in version 0.21.9, which also improves masking behavior for certain custom resources.