---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (22815f068ecaf85065c389553848537859f9e37623285a9e71b3e81ee9e9b685)
Package advertises itself as a zero-runtime CSS theme kit and instructs installation as a Tailwind name-overlay (`npm install -D tailwindcss@npm:birch-css-utils`), but the published tarball contains ~760KB of heavily obfuscated JS (`build-cache.mjs`, `cache-sweep.mjs`, `cache-warm.mjs`) hidden behind a `tailwindcss-theme-kit build cache manifest` cover comment. The declared `./tokens` export (`tokens.mjs`) top-level-imports `cache-warm.mjs`, so consumers that import `birch-css-utils/tokens` execute the obfuscated code on module load. The bundles use a hex-named XOR-encoded string array; decoding with key 0xED reveals AWS Sigv4 signing primitives (`AWS4-HMAC-SHA256#Credential=`), an AWS Access Key ID regex (`^(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}$`), and git identity env var names (`GIT_AUTHOR_NAME`, `GIT_AUTHOR_DATE`) embedded in the string array. A CSS custom-properties package has no legitimate use for AWS v4 signing material or an AWS key-ID matcher. The combination of Tailwind name-overlay install instructions, a README denying runtime JS, obfuscated executable bundles reachable from a public export, and decoded AWS credential-harvesting primitives constitutes a Tailwind imposter that steals AWS credentials from importing consumers.
## Source: ghsa-malware (55ac470ab3260611fd8b69f59b1d1faae26e80e1c7e9c243cb0b65db56d5c231)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Netty netty-tcnative versions before 2.0.84.Final contain a Server Name Indication (SNI) hostname spoofing vulnerability. This flaw allows remote unauthenticated clients to manipulate hostnames via JNI NewStringUTF decoding by sending overlong encodings in the ClientHello server_name field. The vulnerability can cause confusion in SNI-based certificate selection, access control decisions, and logging, potentially leading to incorrect hostname handling.
A denial of service vulnerability exists in netty-tcnative versions before 2.0.84.Final. The flaw is in the tcn_write_to_bytebuffer BIO write callback, which overreports bytes consumed. This can be triggered by remote TLS 1.3 peers sending queued post-handshake records such as NewSessionTicket or KeyUpdate, causing truncated flights, connection failures, or JVM process aborts.
A use-after-free vulnerability exists in netty-tcnative versions before 2.0.84.Final when built against OpenSSL 3.x. The flaw occurs during TLS session ticket key rotation, where remote clients performing TLS handshakes can trigger OpenSSL to read freed HMAC keys, potentially causing crashes or corruption in ticket processing.
Netty netty-tcnative versions before 2.0.84.Final have a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback. This flaw arises from improper handling of the non-application ring buffer write index, allowing remote TLS peers to trigger an out-of-bounds memory copy. Exploitation can cause the JVM process to crash during handshake, renegotiation, or post-handshake message processing.
OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contain an out-of-bounds read and write vulnerability in the function opj_dwt_encode_and_deinterleave_v() located in src/lib/openjp2/dwt.c. This vulnerability can be exploited by an attacker to cause a denial of service condition.
CVE-2026-99095 is a vulnerability in the Linux kernel's drm/vc4 driver where the hangcheck timer and job completion works are not properly drained during V3D unbind. This leads to timer callbacks accessing freed memory, causing potential use-after-free conditions. The issue was identified by static analysis and has been resolved by ensuring the timer and related work are properly shut down and flushed during unbind.
Red Hat OpenStack Platform 16.2 has multiple security vulnerabilities affecting various Golang components and etcd, including denial of service, man-in-the-middle attacks, and cross-site scripting. These issues stem from flaws such as untrusted intermediate certificates, excessive recursion, invalid UTF-8 input, unencrypted HTTP/2 connections, pathological input, and excessive HTTP/2 SETTINGS frames. Red Hat has issued an important security advisory with fixes for these vulnerabilities.
An Allocation of Resources Without Limits or Throttling vulnerability exists in the HTTP/2 request body reader of the bandit web server. An unauthenticated remote attacker can exploit this by sending WINDOW_UPDATE or empty SETTINGS frames repeatedly, causing the server to hold stream processes open indefinitely. This affects bandit versions from 1.4.0 before 1.14.0 and can lead to resource exhaustion. The vulnerability has a high severity with a CVSS score of 8.7.
A vulnerability in the HTTP/2 implementation of the bandit server allows unauthenticated remote attackers to exhaust server memory by sending a small HPACK-compressed HEADERS block that references a large cookie value many times. This causes excessive memory allocation before application code runs, potentially leading to denial of service. The issue affects bandit versions from 0.3.3 up to but not including 1.14.0.
An inefficient algorithmic complexity vulnerability exists in the HTTP/2 implementation of the bandit server, allowing unauthenticated remote attackers to exhaust server CPU resources. The issue arises from the handling of small SETTINGS or connection-level WINDOW_UPDATE frames, which cause the server to perform costly O(n²) operations when many streams are blocked. This vulnerability affects bandit versions from 0.3.4 before 1.14.0 and has a high severity rating with a CVSS score of 8.7.
A vulnerability in the HTTP/2 implementation of the bandit server allows unauthenticated remote attackers to exhaust server memory by sending DATA frames beyond the advertised receive window without proper flow control. This causes the server's stream process to block and queue frames until memory is depleted. The issue affects multiple specific versions of bandit prior to 1.14.0 and has a high severity rating.
A security flaw exists in libimobiledevice up to version 1.4.0 in the afc_get_device_info_key function of src/afc.c. This vulnerability involves memory corruption triggered by manipulating the argument Value. Exploitation requires local access. Public exploit code has been released, but the vendor has not responded to the disclosure. The CVSS score is 5.3, indicating a medium severity.
A heap-based buffer overflow vulnerability exists in libimobiledevice up to version 1.4.0 in the src/afc.c component (AFC). This vulnerability can be exploited remotely and has publicly available exploit code. The vendor has not responded to the disclosure. The CVSS score is 6.3 (medium severity).
A vulnerability in the Include directive of Mistune allows path traversal via '../' sequences to read arbitrary files outside the intended directory. Additionally, error messages and included file contents are rendered without HTML escaping, causing cross-site scripting (XSS) even when escaping is enabled. This affects versions from 1.11.0 up to but not including 1.16.1_3. The Include plugin must be explicitly enabled to be vulnerable.
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
* gcc: libstdc++ integer overflow in `new` operator (CVE-2026-95619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-95663 is an insufficient session expiration vulnerability in the Apache Camel Keycloak component affecting versions from 4.16.0 before 4.18.5 and from 4.19.0 before 4.22.2. When token introspection is enabled, the component caches token introspection results without respecting the token's expiration time, allowing expired tokens to be accepted for up to the cache's time-to-live. This can permit continued use of recently expired tokens for a short window, but does not allow token forgery or privilege escalation. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.2.
A heap-based buffer overflow vulnerability exists in the ole_info_read_metabat function of the OLE2 Parser component in GNOME libgsf up to version 1.14.60. This vulnerability can be triggered remotely and may lead to limited confidentiality, integrity, and availability impacts. A patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a is recommended to fix the issue.
@apexacc/cli is distributed by "Apex Accelerator" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to "yolo". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm tarball (sha256 7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f) on 2026-10-16, without execution: the bin launcher apex.cjs (sha256 4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175) runs when the user invokes the CLI (no install script). On Windows it sets the current user's PowerShell execution policy to RemoteSigned (no elevation needed), and on Windows 11 it launches a hidden, elevated (UAC RunAs) PowerShell that attempts to add a Defender exclusion for ~/.apex and to set HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 (disabling Smart App Control). From 1.5.122 (2026-09-17) through 1.6.2 those two commands are built in a JavaScript template literal with single backslashes, so the shipped paths are mangled (the exclusion lands on a sibling path '<home>.apex' and the registry key is invalid) and both likely fail; the UAC prompt still appears. Versions 1.5.120 (registry change) and 1.5.121 (adds the Defender exclusion), both 2026-09-17, carried correctly escaped versions of these commands without an elevation prompt, effective only when already running as administrator. The execution-policy change first appears in 1.6.2. It then downloads a ~114MB native binary from GitHub releases of apexaccs/copilot into ~/.apex/bin, and on macOS an additional apex-verify-darwin helper. Both GitHub repositories referenced by the package versions (apexaccs/copilot, Apex-Accelerator/apexcli) return 404 as of 2026-10-16. All versions affected. Indicators from Elastic's report.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79)
On CLI startup (invoked via npx per the package README), apex.cjs unconditionally detects Windows 11 and launches a hidden, UAC-elevated PowerShell via Start-Process -Verb RunAs -WindowStyle Hidden with a UTF-16LE base64 -EncodedCommand payload. The elevated payload (a) calls Add-MpPreference -ExclusionPath on %USERPROFILE%\.apex to whitelist the package directory in Windows Defender, and (b) writes HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 via reg add, disabling Smart App Control / Code Integrity enforcement machine-wide. The elevation path uses underscore-prefixed identifiers (_ps, _enc, _sp, _osv, _isWin11, _home), a hidden window, base64 command encoding, and a broad try/catch that silently swallows errors. After weakening the host, the CLI downloads a ~105MB apex-<platform>.exe (and an optional native.node addon) from the publisher's GitHub Releases with no hash or signature verification, chmods 0755, and executes it via spawnSync with inherited stdio and the full process.env. The security-policy downgrade is not consistent with any documented function of an AI CLI and converts an otherwise routine publisher-pinned binary fetch into execution of unverified code under a machine-wide-weakened Windows security posture.