@walknpm/todo-cli@2.0.1 is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, `sh scripts/miner.sh`, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with passwordless sudo it runs the carrier's installer (`sh /tmp/.smi agent`), which installs an XMRig miner plus two helper daemons under random system-component names and persists them as systemd units or @reboot cron entries, and otherwise it extracts the bundled XMRig binary to ~/.local/lib/<random name>/ and mines Monero to networkservicesupp.flashhub.net:8443 over TLS with a hardcoded wallet. The npm account walknpm published the same scripts/miner.sh in dsh-plugin-blender-3d@0.2.1 within 27 seconds of this version on 2026-10-26, and it is byte-identical to the one in @sudobility/testomniac_client (MAL-2026-18129).
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f32e42bc70458d6a0973dfbe2d94961cca2ee423198c53bf753a7680c61df96f)
The package's `postinstall` hook runs `scripts/miner.sh`, which fetches a gzip-compressed payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com (using a hardcoded AWS access key <redacted> in a presigned URL), writes it to `/tmp/.smi`, and executes it via `sh` on every `npm install`. If root or passwordless sudo is available, the script runs `sh /tmp/.smi agent` to install a persistent agent (cron/relay/tor per in-script comments). Otherwise, it extracts an embedded XMRig binary (base64/tar.gz blob after a `__PAYLOAD__` marker), writes a Monero pool configuration to `$HOME/.sysmond.json` pointing at networkservicesupp.flashhub.net:8443 with wallet 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX, copies the miner to `$HOME/.local/lib/<stealth-name>/<stealth-name>` using a system-daemon-like name pool (`edid-mon`, `smmon`, `irqstatsd`,...), and backgrounds it with `nohup`. Installing the package results in unconditional remote code execution on the installer's host, cryptomining compute/electricity theft, and persistence that is non-trivial to detect and remove.
## Source: ghsa-malware (4b1b865efcc7d2ea28c5ad7580b823a36d22c88bc165f9c57a2f42b3accc4d88)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (8c741f8bd0012bceb8789b8e2fc0ac836c5ccb88a348918365af4850f1576be4)
The OpenSSF Package Analysis project identified '@walknpm/todo-cli' @ 2.0.1 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
dsh-plugin-blender-3d@0.2.1 is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, `sh scripts/miner.sh`, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with passwordless sudo it runs the carrier's installer (`sh /tmp/.smi agent`), which installs an XMRig miner plus two helper daemons under random system-component names and persists them as systemd units or @reboot cron entries, and otherwise it extracts the bundled XMRig binary to ~/.local/lib/<random name>/ and mines Monero to networkservicesupp.flashhub.net:8443 over TLS with a hardcoded wallet. The npm account walknpm published the same scripts/miner.sh in @walknpm/todo-cli@2.0.1 within 27 seconds of this version on 2026-10-26, and it is byte-identical to the one in @sudobility/testomniac_client (MAL-2026-18129).
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (08bd399ddec36950a4cb3c82cb8460e95cde40441f464fbff1d215f6a7f13937)
dsh-plugin-blender-3d declares a postinstall script (`sh scripts/miner.sh`) that fires automatically on `npm install`. The script downloads a gzip payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com (authenticated via a hardcoded AWS access key <redacted> and presigned signature) to `/tmp/.smh`, decompresses it to `/tmp/.smi`, and executes it. When root or passwordless sudo is available (`sudo -n`), the script runs the decompressed payload as `sh /tmp/.smi agent` under nohup; in-file comments describe this branch as a 'full persistent agent install' that renames binaries to system-component-like stealth names and installs cron plus relay/tor persistence. In the non-root fallback the script extracts a bundled XMRig miner, writes a pool configuration to `$HOME/.sysmond.json` targeting networkservicesupp.flashhub.net:8443, stages the miner under `$HOME/.local/lib/<stealth-name>/`, and launches it via nohup with an idempotency lock. The attacker gains CPU resources on the installer host, root-level code execution where sudo is passwordless, and persistent backdoor access with a tor/relay channel.
## Source: ghsa-malware (de8aa280aeabc3f7fd50e0f22f8b02fd5ae1d61e36e9c3321620853e08e8570a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (ae55a6a112dc0b823afa1c7c0217871c1c19b5d0b77fde2a8ec29d4b26a9549b)
The OpenSSF Package Analysis project identified 'dsh-plugin-blender-3d' @ 0.2.1 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
This security update provides a functional equivalent of RHSA-2026:89859.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:89859.
A criminal group has compromised 953 online stores, mainly Magento shops, by injecting malicious JavaScript loaders into CMS blocks since July 2025. The latest domain used, deepveindrilling.com, employs advanced bot detection via browser fingerprinting to evade scanners. The malicious loader persists by storing code in visitors' localStorage. Attackers exploited known Magento vulnerabilities, including PolyShell and SessionReaper file upload flaws, to gain access. The campaign targets cryptocurrency users with fake Ledger wallet pages. Many stores were reinfected through persistent database access and backdoors, indicating long-term attacker presence despite cleanup efforts.
The URL https://pastebin.com/raw/QGrjKCsR was observed in the wild as part of attacker activity on 2026-10-25. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation purposes. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure in Great Britain. There are no known exploits actively using this URL, and no specific affected software versions have been identified.
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes
me realize that is_in_v2_mode() may be called in a context where a new
cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root
pointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode
flag which is set when the cpuset_v2_mode mount option is used. This
flag is written into only when cpuset_bind() is being called with a
stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is
modified to read the new cpuset_v2_mode flag instead of accessing
cpuset_cgrp_subsys.root directly.
[1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
The securityheaders.com API is no longer accepting new API keys and is effectively deprecated. Users are advised to switch to an alternative API provided by https://httpsornot.com, which offers similar functionality for checking HTTP security headers with a rate limit of 120 requests per hour per IP without requiring an API key. The new API uses a different JSON response format and grading system. This change does not represent a security vulnerability but rather a service discontinuation and migration notice.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.
### Patches
This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.
### Patches
This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.
### Patches
This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4219](https://github.com/py-pdf/pypdf/pull/4219).
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Non security issue fixed:
- SELinux CIL files are not shipped in Docker (bsc#1278193).
Changes for docker:
- Update to Docker 29.7.2. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/29/#2972>
fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
- Update to buildx 0.36.1. See upstream changelog online at
<https://github.com/docker/buildx/releases/tag/v0.36.1>
CVE-2026-77157 is a vulnerability in the Checkmarx ast-cli tool where helper binaries downloaded during operation were not verified for integrity before execution. This flaw allowed an attacker capable of compromising the download server to substitute malicious binaries, which could then be executed on developer machines or CI pipelines using affected versions. The vulnerability has been addressed by implementing SHA-256 checksum verification of downloaded archives prior to extraction.
CVE-2026-77156 is a path traversal vulnerability in the tar extraction logic of Checkmarx's ast-cli tool on Linux and macOS. It allows crafted tar archives containing absolute or traversal paths to write files outside the intended installation directory. Windows versions are not affected due to built-in path validation. The vulnerability requires an attacker to compromise the archive download source. The issue is fixed in version 2.3.51 by validating extraction paths to ensure they remain within the working directory.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.14.76. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:82781
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/
Security Fix(es):
* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
* kernel: sctp: prevent peer transport count overflow (CVE-2026-74469)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.70. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:82813
Security Fix(es):
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.