8/10(UTC)の観測は、Malware 64 unique(生100)、脆弱性はCVE/GHSA 94件(C6/H30/M36/L22)+Pre-CVE 15件。本日の観測では、内部システムを想起させる共通の接頭辞を持つパッケージ群がまとまって確認されたほか、既存の正規パッケージに酷似した名称によるtyposquatも検出された。脆弱性についても多数が別掲されており、総じて警戒を要する状況が続いている。
マルウェア 64 / Critical 6 / High 30 / 脆弱性合計 94 / pre-CVE 15
エコシステム(生): npm 74 / vscode 9 / nuget 8 / pypi 5 / firefox 4
🚨 共通接頭辞「dip」の名称を 5 パッケージで観測
🚨 共通接頭辞「@bobfrankston」の名称を 3 パッケージで観測
🚨 共通接頭辞「upshift」の名称を 3 パッケージで観測
| 区分 | 8/6 | 8/7 | 8/8 | 8/9 | 8/10 |
|---|---|---|---|---|---|
| Critical | 3 | 1 | 0 | 1 | 6 |
| High | 13 | 7 | 0 | 0 | 30 |
| Medium | 13 | 8 | 0 | 0 | 36 |
| Low | 5 | 6 | 0 | 0 | 22 |
| Pre-CVE | 5 | 1 | 0 | 0 | 15 |
| Malware unique | 84 | 180 | 92 | 23 | 64 |
過去日は前号確定値(DB)を再掲。データ日=2026-08-10。
| パッケージ | 言語 | ID | 深刻度 | スコア | 内容 | 修正版 |
|---|---|---|---|---|---|---|
| sbt | JAVA | AIKIDO-2026-310773 / GHSA-m2pw-22cj-jq4v | Critical | 98 | Improper Authorization | 1.12.15 / 2.0.6 |
| spiral/session | PHP | AIKIDO-2026-501569 / GHSA-c84m-p8px-4wpx | Critical | 98 | Path Traversal | 3.13.1 / 3.17.1 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-677785 / CVE-2026-59650 | Critical | 93 | Improper Input Validation | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-582928 / CVE-2026-58062 | Critical | 93 | Improper Certificate Validation | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-845849 / CVE-2026-8763 | Critical | 93 | Improper Certificate Validation | 1.85.0 |
| isolated-vm | JS | AIKIDO-2026-907567 / GHSA-864f-rcv7-6rh4 | Critical | 90 | Type Confusion | 6.2.0 / 7.0.1 |
| roots/wordpress | PHP | AIKIDO-2026-76686 / CVE-2026-64638 | High | 89 | Cross-Site Scripting (XSS) | 7.0.3 / 6.9.6 / 6.8.7 / 6.7.6 / 6.6.6 / 6.5.9 / 6.4.9 / 6.3.9 / 6.2.10 / 6.1.11 / 6.0.13 / 5.9.15 / 5.8.14 / 5.7.16 / 5.6.18 / 5.5.19 / 5.4.20 / 5.3.22 / 5.2.25 |
| johnpbloch/wordpress-core | PHP | AIKIDO-2026-590188 / CVE-2026-64638 | High | 89 | Cross-Site Scripting (XSS) | 7.0.3 / 6.9.6 / 6.8.7 / 6.7.6 / 6.6.6 / 6.5.9 / 6.4.9 / 6.3.9 / 6.2.10 / 6.1.11 / 6.0.13 / 5.9.14 / 5.8.14 / 5.7.16 / 5.6.18 / 5.5.19 / 5.4.20 / 5.3.22 / 5.2.25 / 5.1.23 / 5.0.26 / 4.9.30 / 4.8.29 / 4.7.34 |
| mistral-vibe | PYTHON | AIKIDO-2026-437084 / CVE-2026-67623 | High | 88 | Remote Code Execution | 2.23.3 |
| bcutil-jdk18on | JAVA | AIKIDO-2026-526143 / CVE-2026-59645 | High | 87 | Uncontrolled Recursion | 1.85.0 |
| bcmls-jdk18on | JAVA | AIKIDO-2026-319222 / CVE-2026-12852 | High | 87 | Uncontrolled Resource Consumption | 1.85.0 |
| bcmls-jdk18on | JAVA | AIKIDO-2026-695025 / CVE-2026-59644 | High | 87 | Security Vulnerability | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-448914 / CVE-2026-58061 | High | 87 | Improper Validation of Integrity Check Value | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-307106 / CVE-2026-58060 | High | 87 | Uncontrolled Resource Consumption | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-495603 / CVE-2026-58059 | High | 87 | Inefficient Algorithmic Complexity | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-473893 / CVE-2026-14682 | High | 87 | Uncontrolled Resource Consumption | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-439774 / CVE-2026-13506 | High | 87 | Uncontrolled Recursion | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-38955 / CVE-2026-12860 | High | 87 | Improper Verification of Cryptographic Signature | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-391408 / CVE-2026-12816 | High | 87 | Improper Validation of Integrity Check Value | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-652915 / CVE-2026-12803 | High | 87 | Improper Validation of Integrity Check Value | 1.85.0 |
| bestzip | JS | AIKIDO-2026-761465 / GHSA-p87m-9567-rgcc | High | 84 | Argument Injection | 2.2.6 / 3.0.2 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-546016 / GHSA-m5cq-cx25-qw53 | High | 81 | Heap-based Buffer Overflow | 3.4.14 |
| HtmlSanitizer | DOTNET | AIKIDO-2026-667119 / GHSA-464h-4j8h-q5mf | High | 75 | Denial of Service (DoS) | 9.0.967 |
| viperjs | RUST | AIKIDO-2026-68991 / GHSA-6976-qm5m-7mcj | High | 75 | Denial of Service | 0.2.2 |
| @fastify/static | JS | AIKIDO-2026-221297 / CVE-2026-18427 | High | 75 | Path Traversal | 10.1.3 |
| playwrightcapture | PYTHON | AIKIDO-2026-462988 / CVE-2026-63175 | High | 71 | Information Disclosure | 1.40.3 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-758882 / CVE-2026-12185 | High | 71 | Uncontrolled Resource Consumption | 1.85.0 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-978773 / CVE-2026-59651 | High | 71 | Inadequate Encryption Strength | 1.85.0 |
| OpenEXR | PYTHON | AIKIDO-2026-540563 / CVE-2026-68513 | High | 70 | Heap-based Buffer Overflow | 3.3.13 / 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-676354 / CVE-2026-61703 | High | 70 | Heap-based Buffer Overflow | 3.3.13 / 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-399123 / CVE-2026-68514 | High | 70 | Heap-based Buffer Overflow | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-182055 / CVE-2026-59985 | High | 70 | Out-of-bounds Read | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-552159 / CVE-2026-59983 | High | 70 | Out-of-bounds Read | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-282890 / CVE-2026-59984 | High | 70 | Heap-based Buffer Overflow | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-315471 / CVE-2026-59186 | High | 70 | Out-of-bounds Write | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-468680 / CVE-2026-59982 | High | 70 | Heap-based Buffer Overflow | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-195948 / GHSA-mqmw-xv8w-5jh4 | Medium | 69 | NULL Pointer Dereference | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-631050 / GHSA-29q6-4p2c-77qq | Medium | 69 | NULL Pointer Dereference | 3.4.14 |
| bcprov-jdk14 | JAVA | AIKIDO-2026-708054 / CVE-2026-59652 | Medium | 69 | LDAP Injection | 1.85.0 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-233266 / GHSA-fhfq-mv64-6q4j | Medium | 63 | Out-of-bounds Write | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-388445 / CVE-2026-59184 | Medium | 61 | Out-of-bounds Write | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-340437 / CVE-2026-59187 | Medium | 61 | Heap-based Buffer Overflow | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-64261 / GHSA-xc77-xm9h-qxm4 | Medium | 61 | Out-of-bounds Write | 3.4.14 |
| spiral/stempler | PHP | AIKIDO-2026-28946 / GHSA-wpjr-ppfr-7m6v | Medium | 61 | Cross-Site Scripting (XSS) | 3.17.2 |
| OpenEXR | PYTHON | AIKIDO-2026-556178 / CVE-2026-68516 | Medium | 55 | Stack-based Buffer Overflow | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-698682 / CVE-2026-65979 | Medium | 55 | Out-of-bounds Read | 3.4.13 |
| OpenEXR | PYTHON | AIKIDO-2026-83636 / CVE-2026-59183 | Medium | 55 | Denial of Service | 3.3.13 / 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-732202 / GHSA-hphq-wq62-4mj3 | Medium | 55 | Denial of Service | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-428461 / CVE-2026-65979 | Medium | 55 | Out-of-bounds Read | 3.4.13 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-388578 / CVE-2026-59981 | Medium | 55 | Out-of-bounds Read | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-321780 / CVE-2026-59189 | Medium | 55 | Out-of-bounds Read | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-630697 / CVE-2026-61555 | Medium | 55 | Denial of Service | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-759752 / CVE-2026-59183 | Medium | 55 | Denial of Service | 3.3.13 / 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-847130 / CVE-2026-68515 | Medium | 55 | Out-of-bounds Write | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-760901 / CVE-2026-68516 | Medium | 55 | Stack-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-918787 / GHSA-hphq-wq62-4mj3 | Medium | 55 | Denial of Service | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-325984 / GHSA-7828-c4f6-7v6p | Medium | 54 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-194918 / GHSA-7828-c4f6-7v6p | Medium | 54 | Information Disclosure | 3.4.14 |
| awcodes/filament-curator | PHP | AIKIDO-2026-972512 / GHSA-fc8p-659h-3959 | Medium | 54 | Cross-Site Scripting (XSS) | 4.1.5 / 5.1.5 |
| rhukster/dom-sanitizer | PHP | AIKIDO-2026-904361 / GHSA-jfrr-ch68-f2w9 | Medium | 54 | Cross-Site Scripting (XSS) | 1.0.12 |
| bcprov-jdk18on | JAVA | AIKIDO-2026-790923 / CVE-2026-58063 | Medium | 53 | Allocation of Resources Without Limits or Throttling | 1.85.0 |
| openssl | OS | AIKIDO-2026-247481 / CVE-2026-54876 | Medium | 53 | Memory Leak | 3.6.4 / 4.0.2 |
| pypdf | PYTHON | AIKIDO-2026-505281 / GHSA-fwg2-594c-jp42 | Medium | 48 | Denial of Service (DoS) | 6.15.0 |
| pypdf | PYTHON | AIKIDO-2026-150856 / GHSA-fp3f-mc75-235c | Medium | 48 | Denial of Service (DoS) | 6.15.0 |
| pypdf | PYTHON | AIKIDO-2026-930803 / GHSA-fc8x-2rww-xw9m | Medium | 48 | Denial of Service (DoS) | 6.15.0 |
| OpenEXR | PYTHON | AIKIDO-2026-830125 / GHSA-9c7r-mp54-x46f | Medium | 43 | Information Disclosure | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-459919 / CVE-2026-62986 | Medium | 43 | Information Disclosure | 3.3.13 / 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-213131 / GHSA-c32g-9w8w-3px6 | Medium | 43 | Information Disclosure | 3.3.13 / 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-444133 / GHSA-8ggg-fhxp-95p9 | Medium | 43 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-894948 / GHSA-9c7r-mp54-x46f | Medium | 43 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-664951 / GHSA-8ggg-fhxp-95p9 | Medium | 43 | Information Disclosure | 3.4.14 |
| ip-range-check | JS | AIKIDO-2026-770647 / GHSA-87xc-4hwr-pxf6 | Medium | 40 | Server-Side Request Forgery (SSRF) | 0.2.1 |
| @mikro-orm/core | JS | AIKIDO-2026-189719 / GHSA-93qp-gfm8-3hc7 | Low | 37 | Prototype Pollution | 7.1.11 |
| OpenEXR | PYTHON | AIKIDO-2026-784609 / GHSA-r864-gwqv-q2hp | Low | 33 | Information Disclosure | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-872621 / GHSA-wwx8-2v36-rhr8 | Low | 33 | Information Disclosure | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-737021 / GHSA-38j8-88v6-jrm7 | Low | 33 | Information Disclosure | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-567866 / GHSA-fwhm-jj7c-mx7v | Low | 33 | Information Disclosure | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-960273 / GHSA-7hgm-jxjc-6hgg | Low | 33 | Information Disclosure | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-252718 / GHSA-prr3-4q3r-hmf3 | Low | 33 | Use of Uninitialized Memory | 3.4.14 |
| OpenEXR | PYTHON | AIKIDO-2026-70412 / GHSA-cx6p-vjc6-3php | Low | 33 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-313186 / GHSA-pgc2-hppj-q623 | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-114629 / GHSA-g5m8-8w79-34q8 | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-958975 / GHSA-r8mj-rhfc-38g4 | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-467152 / GHSA-r24r-74rc-588f | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-426950 / GHSA-h56j-j82x-w3fp | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-214285 / GHSA-wrw5-mm52-r3h8 | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-328026 / GHSA-wwx8-2v36-rhr8 | Low | 33 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-995464 / GHSA-7h7v-98cr-8ppw | Low | 33 | Heap-based Buffer Overflow | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-466544 / GHSA-38j8-88v6-jrm7 | Low | 33 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-212891 / GHSA-r864-gwqv-q2hp | Low | 33 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-502923 / GHSA-fwhm-jj7c-mx7v | Low | 33 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-492697 / GHSA-7hgm-jxjc-6hgg | Low | 33 | Information Disclosure | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-411897 / GHSA-prr3-4q3r-hmf3 | Low | 33 | Use of Uninitialized Memory | 3.4.14 |
| AcademySoftwareFoundation.openexr | C++ | AIKIDO-2026-26571 / GHSA-cx6p-vjc6-3php | Low | 33 | Information Disclosure | 3.4.14 |
Pre-CVE:
| パッケージ | 言語 | ID | 深刻度 | スコア | 内容 | 修正版 |
|---|---|---|---|---|---|---|
| workerd | JS | AIKIDO-2026-920595 | Pre-CVE | 67 | Denial of Service (DoS) | 1.20260808.1 |
| ox | RUBY | AIKIDO-2026-33398 | Pre-CVE | 65 | Out-of-bounds Write | 2.14.29 |
| mammoth | JS | AIKIDO-2026-935898 | Pre-CVE | 65 | Denial of Service (DoS) | 1.12.1 |
| katex | JS | AIKIDO-2026-293837 | Pre-CVE | 59 | Prototype Pollution | 0.18.2 |
| mammoth | JS | AIKIDO-2026-910675 | Pre-CVE | 59 | Path Traversal | 1.12.1 |
| zstd-ruby | RUBY | AIKIDO-2026-36364 | Pre-CVE | 59 | Out-of-bounds Read | 2.0.7 |
| arrow-avro | RUST | AIKIDO-2026-702909 | Pre-CVE | 59 | Uncontrolled Resource Consumption | 59.2.0 |
| nodemailer | JS | AIKIDO-2026-442290 | Pre-CVE | 54 | CRLF Injection | 9.0.5 |
| postal-mime | JS | AIKIDO-2026-297362 | Pre-CVE | 53 | Denial of Service (DoS) | 2.7.6 |
| cbor2 | PYTHON | AIKIDO-2026-413819 | Pre-CVE | 53 | Denial of Service (DoS) | 6.1.4 |
| quickjs-wasi | JS | AIKIDO-2026-657657 | Pre-CVE | 50 | Uncontrolled Resource Consumption | 3.3.1 |
| better-auth | JS | AIKIDO-2026-906996 | Pre-CVE | 45 | User Enumeration | 1.6.26 |
| electron | JS | AIKIDO-2026-917501 | Pre-CVE | 42 | Sandbox Bypass | 41.10.4 / 42.5.2 |
| @noble/curves | JS | AIKIDO-2026-26118 | Pre-CVE | 37 | Observable Timing Discrepancy | 2.3.0 |
| google-adk | PYTHON | AIKIDO-2026-459021 | Pre-CVE | 32 | Server-Side Request Forgery (SSRF) | 2.6.0 |
共通接頭辞別の観測数(3件以上): dip 5・@bobfrankston 3・upshift 3
内部システム風の接頭辞を共有する複数のパッケージがまとまって観測されることは、組織内部のツール名や命名規則を事前に把握したうえで標的を絞り込もうとする意図と整合する可能性がある。ただし現時点では単一のキャンペーンや同一主体によるものとは断定できず、引き続き挙動の精査が必要である。typosquatについても、開発者が依存関係を手動入力する際のタイプミスを狙った古典的かつ実効性の高い手法であり、継続的な監視が求められる。
前日(8/9)のMalware uniqueは23、当日(8/10)は64。マルウェアの検出数は前日から増加傾向にあり、短期的な観測推移としては上向きの動きが継続している。予断を許さない状態が続いているため、引き続きリアルタイムの脅威フィードとの照合を怠らないことが重要である。
Aikido Community Japan
公開日: 2026/8/10
最終更新: 2026/8/10