Trending Vulnerabilities – Real-Time CVE Threat Radar

11 Score

CVE-2026-20349 HIGH CWE-244

Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and FTD Software across a broad range of versions, enabling unauthenticated remote attackers to force an unexpected device reload and take down the firewall entirely. The Changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the VPN process itself to the entire device, disrupting all traffic passing through it. This vulnerability is confirmed actively exploited (CISA KEV), with SSVC marking it as automatable, making it a high-priority remediation target for any organization with internet-exposed ASA or FTD VPN endpoints.

KEV Poc News Buzz Denial Of Service Cisco Adaptive Security Appliance Software Secure Firewall Threat Defense KEV PoC No patch available

8.6

CVSS 3.1

1.0%

EPSS

119

Priority

8 Score MAL

MAL-2026-13478 CRITICAL

The npm package @cats-cdf/authentication was found to contain a malicious preinstall lifecycle script that executes automatically when a developer runs npm install, requiring no further interaction to trigger. The script silently harvests the installing user's local username via whoami, the machine hostname, and the host's public IP address fetched from ifconfig.me, then exfiltrates all three values as query-string parameters in an HTTP GET request to the hardcoded callback domain kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun, a subdomain of the oast.fun out-of-band interaction service commonly used in dependency-confusion and supply chain reconnaissance campaigns. Any developer or CI/CD pipeline that installed this package has had their system identity and network egress IP exposed to the attacker's collection infrastructure, which may be used for follow-on targeting. All versions of @cats-cdf/authentication should be treated as malicious; the package should be removed immediately from node_modules and package.json, npm cache should be cleared, and any secrets or credentials present on affected machines should be rotated under the assumption that the environment's network identity is now known to the attacker. The oast.fun callback domain and the IP address resolving it should be blocked at the perimeter and reviewed in outbound firewall and DNS logs to identify which systems made contact.

News Buzz Cvss 9plus Supply Chain 11 news

11

News

8 Score MAL

MAL-2026-13521 CRITICAL

The npm package @rbxst/services, which presents itself as a roblox-ts service type utility library, was found to contain a malicious postinstall script that executes automatically during npm install on Windows systems. The script fetches a ZIP archive from the anonymous file-hosting service catbox.moe, unpacks it to a randomized temporary directory using PowerShell, and then silently launches a bundled Python interpreter (pythonw.exe) against a payload script (exec_.py) with process detachment and hidden window flags, meaning the malicious process continues running after the install completes and leaves no visible trace to the developer. This matches a known alternate-runtime dropper pattern where the npm package itself is merely a delivery vehicle for an opaque remote payload that executes with the privileges of whoever ran npm install, and because the remote ZIP is hosted on mutable infrastructure, the payload could be swapped at any time without changing the package itself. Any developer or CI system running on Windows that installed any version of @rbxst/services should treat the machine as compromised, rotate all credentials and secrets accessible from that environment, and audit running processes for orphaned Python instances. Remove the package immediately, do not install any version of it, and report the catbox.moe URL rp8idk.zip as a known malicious indicator to your security team for network-level blocking.

News Buzz Cvss 9plus Supply Chain 7 news

7

News

8 Score MAL

MAL-2026-13691 CRITICAL

The npm package @rblxts/services is a typosquat of the legitimate @rbxts/services package, containing a malicious postinstall script that automatically executes on any npm install. The script is heavily obfuscated using hex escapes and base64 encoding to evade string-based scanners, and on Windows systems it decodes a hardcoded URL pointing to an anonymous file host (files.catbox.moe) to download a zip archive, which is unpacked into a randomly-named directory disguised under %LOCALAPPDATA%\Microsoft to blend in with legitimate system paths. Once extracted, the package silently spawns a bundled pythonw.exe interpreter against a companion script named exec_.py, running fully detached with a hidden window and no standard I/O, meaning the malicious process persists independently of the npm install session and leaves no visible trace to the developer. Any developer or build pipeline on Windows that has run npm install with @rblxts/services present in their dependency tree should treat the host machine as compromised, remove the package immediately, rotate all credentials and tokens accessible from that environment, and audit running processes and the %LOCALAPPDATA%\Microsoft directory for unexpected subdirectories or pythonw.exe instances. There is no patched version; the entire package is malicious and should be blocked at the registry level - teams should audit package.json and lockfiles across all projects for any reference to @rblxts/services and ensure dependency scanning tooling flags typosquats of the @rbxts namespace going forward.

News Buzz Cvss 9plus Supply Chain 7 news

7

News

8 Score MAL

MAL-2026-13630 CRITICAL

The npm package @rbx-ts/services, advertised as Roblox TypeScript type definitions, contains a malicious postinstall script that triggers automatically on Windows during npm install. The script is obfuscated with hex-escaped identifiers and base64 encoding to conceal standard API names including https, fs, child_process, powershell, and .exe references; at runtime it decodes a base64 URL resolving to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, extracts it via PowerShell Expand-Archive, finds the first executable in the extracted tree, and spawns it as a detached process before deleting the archive. Because the payload is hosted on an anonymous, attacker-controlled throwaway file host with no hash verification or version pinning, the dropped binary can be silently swapped for any payload at any time, making the full scope of the delivered malware unknown without dynamic analysis of the specific file retrieved at installation time. Any Windows developer who installed @rbx-ts/services should treat the host machine as fully compromised, immediately rotate all credentials, tokens, and secrets accessible from that environment, and audit running processes and scheduled tasks for unknown executables. No safe version of this package exists; it should be removed immediately, blocked at the registry or firewall level, and the catbox.moe domain should be treated as an indicator of compromise for network-level detection.

News Buzz Cvss 9plus Supply Chain 7 news

7

News

8 Score MAL

MAL-2026-13407 CRITICAL

The npm package @0l00000l/auth was identified as a credential-harvesting malicious package masquerading as a generic authentication library. Any Express application that mounts its route handlers - including register, login, logout, verifyEmail, forgotPassword, resetPassword, and verifyToken - will silently forward the full req.body of every authentication request, including plaintext passwords, email addresses, and Authorization headers, to a hardcoded attacker-controlled endpoint at be-aauth-production.up.railway.app. The package name uses digit-to-letter homoglyphs to impersonate a legitimate auth utility, and its README contains no disclosure of this exfiltration behavior. All applications that installed and integrated this package are affected and should be treated as fully compromised with respect to any credentials their users submitted through the mounted handlers. There is no safe version of this package; the malicious behavior is baked into the code with no environment-variable override or configuration API to disable it. Immediate action requires removing @0l00000l/auth from all dependency trees and redeploying affected services. All end-user credentials - passwords and tokens - collected through the affected handlers must be invalidated and users forced to reset passwords. Application logs should be reviewed for outbound requests to be-aauth-production.up.railway.app, which serves as the primary indicator of compromise. The package should be blocked at the registry level, and any CI/CD pipelines that installed it should be audited for downstream artifact contamination.

News Buzz Cvss 9plus Supply Chain 6 news

6

News

7 Score GHSA

GHSA-cgq2-qp6c-q4rm CRITICAL

The npm package @cats-cdf/authentication versions 2.17.1 and 3.1.1 were found to contain malicious code that executes automatically during installation via a preinstall lifecycle hook, requiring no action from the developer beyond running npm install. The script silently harvests the installing user's local username via whoami, the system hostname, and the machine's public IP address fetched from ifconfig.me, then exfiltrates all three values as query-string parameters in an HTTP GET request to the hardcoded callback domain kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun, a subdomain of oast.fun, a service widely associated with out-of-band data exfiltration in supply chain reconnaissance campaigns. This pattern is characteristic of dependency confusion attacks, where adversaries publish packages to public registries using names that mirror internal or private package identifiers, hoping developers or CI pipelines inadvertently resolve the malicious public version. Any developer or automated build system that installed either affected version should treat the exposed host as potentially fingerprinted and rotate or audit credentials associated with that environment, particularly if the machine had access to sensitive internal networks or secrets at install time. Both versions 2.17.1 and 3.1.1 should be removed immediately; there are no safe versions of this package and it should be blocked entirely in package allow-lists and dependency scanners.

News Buzz Cvss 9plus 11 news

11

News

7 Score GHSA

GHSA-2846-4m8r-rvv5 CRITICAL

Version 1.6.0 of the npm package @rbx-ts/services, advertised as Roblox TypeScript type definitions, was found to contain a malicious postinstall script that executes automatically upon installation. The script uses heavy obfuscation-hex-escaped identifiers and base64-encoded strings-to conceal references to sensitive APIs including `child_process`, `fs`, and `powershell`; on Windows systems, it decodes a hardcoded URL pointing to `files.catbox.moe/9bppy2.zip`, downloads the archive to the system TEMP directory, extracts it via PowerShell's Expand-Archive, and silently spawns the first executable found in the extracted tree as a detached process before deleting the archive. The payload host is an anonymous, attacker-controlled throwaway file service with no hash verification or version pinning, meaning the delivered binary could be swapped at any time without changing the package itself, compounding the risk for any Windows developer who installed this version. Any system that ran `npm install @rbx-ts/services@1.6.0` on Windows should be treated as fully compromised: the executed binary's capabilities are unknown but the delivery mechanism is consistent with remote access trojan or infostealer deployment. Immediate action includes removing the package, rotating all credentials and tokens accessible from the affected machine, auditing process and network logs for anomalous activity originating from the TEMP directory, and blocking the domain `files.catbox.moe` at the network perimeter; there is no patched version-the package should be removed entirely and its maintainer account treated as compromised.

News Buzz Cvss 9plus 7 news

7

News

7 Score GHSA

GHSA-x6xv-2jr9-4pc5 CRITICAL

The npm package @rblxts/services version 1.6.2 is a malicious typosquat of the legitimate @rbxts/services package used in the Roblox TypeScript ecosystem, distinguished only by an extra letter 'l' in the scope name. The package's postinstall script deliberately obfuscates references to Node.js APIs and encodes a hardcoded URL pointing to an anonymous catbox.moe file host, then on Windows systems downloads a ZIP archive to the %TEMP% directory, extracts it via PowerShell, and silently executes any .exe binaries found inside using detached, hidden child processes with no hash or signature verification performed. Any Windows developer who ran npm install and pulled version 1.6.2 of @rblxts/services may have arbitrary attacker-controlled executables running on their machine; because the payload is fetched from a mutable, unauthenticated host, the delivered binary could have changed between installations, making retrospective analysis of what was actually executed unreliable without endpoint forensics. The obfuscation of core API names was specifically designed to evade automated registry scanning, and the package mimics the README and API surface of the real @rbxts/services to reduce suspicion during human review. Developers should immediately remove @rblxts/services from all dependency manifests and lock files, verify they intended to depend on @rbxts/services (the legitimate package), and treat any Windows system that installed version 1.6.2 as potentially compromised, warranting full incident response including credential rotation, inspection of running processes, and review of persistence mechanisms. The catbox.moe URL https://files.catbox.moe/9bppy2.zip and the package itself at version 1.6.2 serve as indicators of compromise; there are no safe or patched versions of @rblxts/services and the package should not be used at any version.

News Buzz Cvss 9plus 7 news

7

News

7 Score GHSA

GHSA-3f44-96fh-85xw CRITICAL

The npm package @rbxst/services version 1.0.756, which presents itself as a roblox-ts service type utility library, was found to contain a malicious postinstall script that executes automatically during npm install on Windows systems. The script fetches a ZIP archive from the anonymous file-hosting service catbox.moe, unpacks it to a randomized temporary directory using PowerShell, and then silently launches a bundled Python interpreter against a payload script using detached process flags and hidden windows so the execution persists after the npm process exits and leaves no visible trace to the installer. The payload runs with the full privileges of the installing user, and because the remote ZIP is hosted on mutable infrastructure with no integrity verification, the delivered code could change at any time without altering the package itself. Any developer or CI/CD pipeline that ran npm install with @rbxst/services@1.0.756 on a Windows host should treat that machine as compromised, rotate all credentials and tokens accessible from that environment, and audit running processes for unknown Python instances. The affected version should be removed immediately; there is no patched version to upgrade to, so the package should be removed from dependency manifests entirely and blocked at the registry level in any private npm proxy or allowlist configuration.

News Buzz Cvss 9plus 7 news

7

News

7 Score GHSA

GHSA-xg2j-834c-79h6 CRITICAL

The npm package `@0l00000l/auth` versions 1.1.3 and 1.1.4 was identified as malicious supply chain software masquerading as a legitimate authentication library, using digit-letter homoglyphs in its name to evade casual inspection. Any Express application that mounted its route handlers - including register, login, logout, verifyEmail, forgotPassword, resetPassword, or verifyToken - had its users' plaintext passwords, email addresses, and Authorization headers silently exfiltrated to a hardcoded third-party endpoint at `https://be-aauth-production.up.railway.app/api/v1/` on every authentication request, with no environment-variable override or configuration option to disable the behavior. The credential theft was entirely passive from the victim application's perspective, requiring no user interaction beyond normal authentication flows, and the destination URL was embedded as a string literal with no documentation in the package README. Any organization that installed either affected version should treat all credentials processed through those handlers as fully compromised, rotate passwords and invalidate sessions for all affected users immediately, and audit dependencies for the package name across all projects. The package should be removed entirely with no patched version available; the OpenSSF malicious-packages project attributed the discovery, and the advisory was filed under MAL-2026-13407.

News Buzz Cvss 9plus 6 news

6

News

7 Score MAL

MAL-2026-13938 CRITICAL

Malicious code in @kolbo/mcp (npm)

News Buzz Cvss 9plus Supply Chain 5 news

5

News

7 Score MAL

MAL-2026-13627 CRITICAL

Malicious code in @nestjs-passport/jwt (npm)