MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in devplatform-react-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Worker...

CVE-2026-19054 Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

CVE-2026-19054

CVE-2026-19054 affects Lspace-io lspace-server (Repositories File API) with a path traversal in the repository.ts file between fileExists/readFile/writeFile/deleteFile. The vulnerability is triggered by manipulating the argument filePath and is limited to local access. No version details or publi...

CVE-2026-19054 Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

CVE-2026-18980 nearai ironclaw shell.rs classify_command_risk command injection

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

PT-2026-68391

Name of the Vulnerable Software and Affected Versions Tourmaster versions prior to 5.4.9 Description An issue exists where the plugin writes order and booking exports to a fixed, predictable file within a publicly accessible directory. Due to a lack of access control, unauthenticated users can...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

Malicious code in dolyame-ui-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242 [email protected] is published as a React component library but ships no UI code. On require, index.js loads shim.js, which downloads a...

Malicious code in dws-frontend-dws-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb73f65c18cf45f29f533ef6b9ab1278412909686c0750018f9d35170ed39f2 On require of this package, index.js loads support.js which downloads a platform-specific binary over HTTPS from author-controlled hosts under...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

MAL-2026-12593 Malicious code in checkout-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909 On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays e.g...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

MAL-2026-12660 Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

EUVD-2026-53344

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...