3 casos · pág. 1/1
Pillar Security researcher Eilon Cohen disclosed on October 19, 2026 a critical command-injection flaw in the open-source AI coding agent OpenCode (developed by Anomaly). It affects versions 1.0.137 through 1.18.32 on Windows and WSL. A malicious or hijacked remote MCP server can execute code with the developer's own privileges during MCP…
The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, …
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
