Search: 2.9.99.5

The exodus-payments npm package version 99.0.0-canary.1 contains a postinstall hook that performs an outbound DNS lookup and HTTPS GET request to a third-party Serveo tunnel host. This request sends only the package name and version, revealing the installer's public egress IP address. The package is self-identified as a dependency-confusion proof-of-concept and does not steal credentials, execute remote code, or maintain persistence. The behavior raises concerns about install-time outbound network activity without opt-out and use of a mutable third-party endpoint.

The npm package ecto-cargo-wk1tm59a version 99.0.0 exhibits suspicious characteristics typical of potentially malicious or disposable packages. These include a randomized suffix in the package name, an unusually high version number, and a minimal number of files. Automated analysis did not identify explicit malicious behavior such as exfiltration or install-time code execution, but the package contents were complex enough to prevent automated summarization. No known exploits or attacker infrastructure have been identified. Human review is recommended before trusting this package.

The npm package @public-for-cdao/core version 99.99.99 contains malicious code. This is identified as a malicious package threat in the npm ecosystem. No CVSS score or detailed technical description is provided.

The npm package @dxcl/http-common-js version 99.99.99 contains malicious code. This is identified as a malicious package rather than a traditional vulnerability with a CVE score. There is no information about patches or fixes, and no known exploits in the wild have been reported. The package is not a cloud service, so remediation depends on users removing or replacing the affected version.

# CVE-2026-45799 ## Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented `IOException` / `ProtocolException` failure path. This can crash services that decode untrusted protobuf payloads and only handle Wire's documented checked decoding failures. ## Affected artifacts ### `com.squareup.wire:wire-runtime` Affected versions: vulnerable releases before `6.3.0`. Patched versions: `6.3.0` and later. Users should upgrade to `com.squareup.wire:wire-runtime:6.3.0` or later. ### `com.squareup.wire:wire-runtime-jvm` Affected versions: vulnerable releases before `6.3.0`. Patched versions: `6.3.0` and later. Users should upgrade to `com.squareup.wire:wire-runtime:6.3.0` or later. ### Wire 7 alpha releases The fix has been merged to `master` and will be included in the next Wire 7 alpha release. Until that release is available, Wire 7 alpha users should avoid decoding untrusted protobuf payloads with affected alpha versions or build from a commit containing the fix. ## Fix The issue is fixed in Wire `6.3.0`. The fix rejects negative lengths while skipping groups and throws `ProtocolException` instead of allowing the reader to move to an invalid position and later throw an unchecked runtime exception. ## Credit Reported by @TrekLaps. ## Technical details The following technical details are based on the original report, updated by the maintainers to reflect the assigned CVE, the supported fixed artifact, and the discontinued status of `com.squareup.wire:wire-runtime-jvm`. `ByteArrayProtoReader32.skipGroup()` in `wire-runtime` did not validate that a `LENGTH_DELIMITED` field's length is non-negative before calling `skip()`. A crafted protobuf varint encodes `-128` as a signed `Int`. When `skip(-128)` runs, the internal position counter underflows to an invalid negative position. The next `readByte()` accesses the source with that negative position, throwing `ArrayIndexOutOfBoundsException`, a `RuntimeException` that escapes Wire's documented `IOException` boundary and can crash the request handler. `ProtoAdapter.decode(byte[])` is declared to throw `IOException`. Callers following the documented API may catch only `IOException`, so unchecked runtime exceptions from malformed input can escape the expected error boundary. The originally confirmed vulnerable legacy versions include `5.3.1` and `5.3.3` for the discontinued `com.squareup.wire:wire-runtime-jvm` coordinate. The supported replacement coordinate is `com.squareup.wire:wire-runtime`, fixed in version `6.3.0`. ## Root cause In the originally reported vulnerable code path, `ByteArrayProtoReader32.skipGroup()` read the length as a signed `Int` and used it without validating that it was non-negative: ```kotlin STATE_LENGTH_DELIMITED -> { val length = internalReadVarint32() // returns signed Int and can be negative skip(length) // no negative check } ``` The internal `skip()` implementation then accepted the negative count because the computed position was not greater than the limit: ```kotlin private fun skip(byteCount: Int) { val newPos = pos + byteCount // for example, 7 + (-128) = -121 if (newPos > limit) throw EOFException() pos = newPos // pos = -121 } ``` The next read could then index the source with the invalid negative position: ```kotlin private fun readByte(): Byte { if (pos == limit) throw EOFException() return source[pos++] // source[-121] throws ArrayIndexOutOfBoundsException } ``` Wire already rejected negative lengths in normal length-delimited field decoding. The same validation was missing from group-skipping code. The fix adds this validation when skipping groups: ```kotlin STATE_LENGTH_DELIMITED -> { val length = internalReadVarint32() if (length < 0) throw ProtocolException("Negative length: $length...") skip(length) } ``` The fix was applied to both `ByteArrayProtoReader32.skipGroup()` and `ProtoReader.skipGroup()`. ## Reproduction The following reproduction was provided for vulnerable legacy `wire-runtime-jvm` releases such as `5.3.1` and `5.3.3`: ```bash curl -sL https://repo1.maven.org/maven2/com/squareup/wire/wire-runtime-jvm/5.3.3/wire-runtime-jvm-5.3.3.jar -o wire.jar curl -sL https://repo1.maven.org/maven2/com/squareup/okio/okio-jvm/3.9.1/okio-jvm-3.9.1.jar -o okio.jar curl -sL https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar -o stdlib.jar ``` ```java // WirePoc.java import com.squareup.wire.AnyMessage; public class WirePoc { public static void main(String[] args) throws Exception { byte[] payload = new byte[] { (byte) 0x9B, 0x06, // field 99, START_GROUP 0x0A,

The npm package '@hibachi-xyz/types' at version 99.0.0 is identified as malicious. Instead of providing type definitions, it executes code on module load that collects environment variables containing sensitive keywords, gathers host and user information, and fingerprints the host environment. This data is then exfiltrated via an insecure HTTPS POST request with TLS verification disabled. The package appears to be part of a dependency confusion or version squatting attack targeting the '@hibachi-xyz' namespace.

The npm package 'test_adminet' version 99.9.9 contains malicious code that executes automatically during installation. It runs a preinstall script that collects sensitive system information and files, including local user and host identifiers and contents of /etc/passwd, /etc/hosts, and /etc/shadow. The collected data, including password hashes if run with root privileges, is exfiltrated via a crafted HTTP request to a hardcoded external endpoint. This behavior occurs without user interaction during a standard npm install.

The npm package frontend-regulations version 99.9.1 is a near-empty wrapper that declares a dependency on an off-registry tarball hosted on a Google Cloud Storage bucket unrelated to any documented publisher. Installing this package causes npm to fetch and execute lifecycle scripts from this external tarball during installation. The package itself provides no functionality and appears designed to smuggle malicious code into the dependency tree using a dependency-chain dropper pattern.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fd1d5daf09cc7bfff164e60bf5abd0a1b374b5bb616f0a78cac8f6c6ea613608) The package's `prepare` lifecycle script, which runs automatically on `npm install`, collects host, user, and platform identifiers along with the full `process.env` and POSTs them to a hardcoded ngrok tunnel at crabbing-thong-overhung.ngrok-free.dev (path `/?cross_os_cloud=1`). When executed in GitHub Actions, it additionally reads ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN, requests a GitHub Actions OIDC ID token, and includes that token in the exfiltrated payload. The version number (99.9.9) and hardcoded attacker-controlled tunnel destination are consistent with a dependency-confusion / typosquat lure targeting CI environments; the OIDC token can be exchanged for cloud credentials via configured trust relationships. ## Source: ghsa-malware (ba06f85b2f6ed01391c70e5ba328a9bacd99e5c40f62c3fb477e53bdeeb03b0e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (acfd49527fb8be1135feb424b68f6c46779ba146d8372d276eac1735770d6e5a) rtc-integration-frontend-sdk@99.9.0 registers a postinstall lifecycle hook ("postinstall": "node index.js") that fires automatically on npm install. index.js collects installer host reconnaissance — os.hostname(), userInfo().username, platform/arch, local network interface addresses, the public IP resolved via a call to https://api.ipify.org, the current working directory, and the package name — and POSTs the collected data to a hardcoded Discord webhook at discord.com/api/webhooks/. The package name and 99.9.0 version shape are consistent with a typosquat/version-bump lure; installing the package causes unconditional install-time exfiltration of host identifiers to an attacker-controlled endpoint.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (29bea4f118854efa6568545722d7210a76e06e64cad4036e0cc0b45c45aafe37) The package's postinstall hook auto-executes index.js on `npm install`. The script collects the installer's OS username (os.userInfo()), current working directory (process.cwd()), and external IPv4 address from network interfaces, then POSTs them as JSON to a hardcoded interactsh out-of-band collector at dodwqvexnkotaavogofbj9kjz5pltcu7b.oast.fun/receive-data. The package name mimics MercadoLibre's internal 'fury/andes-ui' naming convention and is published at version 99.9.5 to force resolution over any legitimate internal package with the same name — the standard dependency-confusion attack shape. The package ships no library functionality matching its name; its only effect on install is the identity beacon.

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (12870ae203f2612ab2bf9e796583acba17914cd4699909156f86c643fcf51f24) package.json declares postinstall=`node index.js`, which runs automatically on `npm install`. index.js collects host identifiers via os.hostname(), os.userInfo(), and process.cwd(), resolves the external IPv4 address, and POSTs them as JSON to a hardcoded Interactsh-style out-of-band collector at lpzlajzjfkpfeefuzxbv6n5nob7bpuh6e.oast.fun/receive-data over plain HTTP. The package has empty description and author fields and is published at version 99.9.5, a shape consistent with a dependency-confusion squat against a private/internal package name: installing (or accidentally resolving) this name causes a reconnaissance beacon to fire from the developer or CI machine, confirming code execution on the target and leaking host, user, cwd, and network identifiers to the attacker. ## Source: ossf-package-analysis (84540e9e44077c6ea24d8b8dc6093397f9ff6bcac74e53fe1dabfdd37d1a9b95) The OpenSSF Package Analysis project identified 'client-cookies-agent' @ 99.9.5 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f73e9c228fc5188d602b213f2c6e7f88d6acbb4a9381667b7c33e4cb825aedf2) Package `higherlogic-ocfe@99.9.1` is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published `index.js` is an empty `module.exports = {}` — the package ships no functionality. Its sole dependency is declared in `package.json` as a direct tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.1.4.tgz`) rather than a registry-hosted version. On `npm install`, npm fetches that tarball from an arbitrary Google Cloud Storage bucket and executes any lifecycle scripts it contains on the installer's machine. The high version `99.9.1` is the standard dependency-confusion pattern used to override an internal private package of the same name during resolution, and the bucket path segment `depenconf` reinforces the attack intent. The installer cannot audit the fetched bytes via normal registry tooling, and the tarball contents are mutable at the bucket owner's discretion. ## Source: ghsa-malware (4ad1c3e1385f4524e8d0d34b8be29a99f4d3d80a03d8ce6196cad9e0a6cd4468) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (29c50b5a47dde18daf83760926662df3b9890de074cc00938de04892ac79a4d9) ag-charts-test@99.9.1 is a hollow package (empty index.js, no scripts, no documented functionality) whose sole effect on installers is resolving its single dependency `ltidisafe` from a direct HTTPS tarball URL on a third-party Google Cloud Storage bucket (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.1.9.tgz`) rather than through the npm registry. On `npm install`, the tarball is fetched from that bucket and its contents — including any lifecycle scripts — execute on the installer's machine. The bucket owner can mutate the tarball at any time, so the executed bytes are attacker-controlled. The package name mimics the AG Charts / AG Grid namespace and the inflated `99.9.1` version, combined with the `depenconf` path segment on the bucket URL, is the canonical dependency-confusion shape (outbidding an internal `ag-charts-*` name to force resolution of the attacker's package into a private build). No legitimate purpose is documented and the package ships no code of its own. ## Source: ghsa-malware (9075915150ed433ba9729068a51b48f233c3f5366b8fb5ace97015824510c3cc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a0e8f566e285de1eec2c3cae07b0faaa8828080a4e1fed7e76e1fe43dfa571ec) Package presents as an internal-looking corporate tooling name ('visa-cli-tools') published at an inflated version (99.9.1) — the canonical dependency-confusion shape used to override a private-registry resolution with a public-npm entry. The package body is a hollow stub (index.js exports an empty object), so the package has no library utility; its only on-install effect is dependency resolution. package.json declares a single dependency 'ltidisafe' via a direct URL to a third-party Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.1.2.tgz) rather than a registry name+semver. The URL path segment 'depenconf' explicitly labels the dependency-confusion technique. On `npm install`, the tarball is fetched from the bucket (outside registry review, mutable by the bucket owner at any time) and its contents enter the installer's dependency tree with normal install-time execution rights, including any lifecycle hooks in that tarball. The hollow lure + inflated version + name mimicking an internal namespace + external mutable tarball delivery jointly constitute a dependency-confusion dropper. ## Source: ghsa-malware (cac903d37a7aff709242fbacafae0484a4c42ebbf8856b6758777c75aec7fa63) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package 'dependency_confusions' version 99.9.9 contains malicious code that executes automatically upon installation via a postinstall hook. This code collects sensitive environment information including the installer's OS username, hostname, current working directory, local IPv4 address, and platform, then sends this data to a hardcoded external webhook. This behavior facilitates reconnaissance for dependency confusion attacks by revealing internal build host details and private package namespaces without user consent.

The 'proton-pfff' package version 99.99.5 on crates.io is identified as malicious. It communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. This package poses a high risk to users who include it in their projects.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ed72d8256a1831ef61f01d101c9b9de21db822516cb3b61d1fffd1ef7b3bb0c7) rio-design-tokens@99.99.100 is a dependency-confusion attack package. package.json declares `preinstall: node index.js`, so `npm install` auto-executes index.js, which harvests installer secrets and system data and POSTs them to an attacker-controlled oastify.com (Burp Collaborator) subdomain. Specifically, index.js collects `os.hostname()`, `os.userInfo()`, output of `whoami`/`id`/`pwd` (via `execSync` with curl and other commands), the contents of `~/.npmrc` and `~/.yarnrc` (which contain npm auth tokens), `package-lock.json`, `yarn.lock`, `/etc/os-release`, `/etc/hosts`, probes AWS IMDS, and reads a targeted env-var list including `NPM_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `GITHUB_TOKEN`, `GITLAB_CI`, and `CODEARTIFACT_AUTH_TOKEN`, then sends the aggregated payload via `https.request(... POST)` to `7v343wmb7yqwapwew87n2p4stjzbn4bt.oastify.com`. The package's own metadata self-identifies as "Dependency Confusion POC" with version 99.99.100 and author "YourName" — the canonical shape of a public-registry package intended to shadow a private internal package name during resolution. Installing this package on a developer workstation, CI runner, or build system will exfiltrate registry auth tokens, cloud credentials, and CI secrets to an external collaborator host. ## Source: ghsa-malware (f953c7dfe25e2d7da488167fee4e47d465f58bb2e45a0e52ccdba8f0ae267109) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (e83e18c7c88cb4c0e488342a49e4d0733087fa7e7ea7e833f1fbb6e8fbf5a35e) The OpenSSF Package Analysis project identified 'rio-design-tokens' @ 99.99.100 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.