MAL-2026-13342 Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

MAL-2026-13216 Malicious code in akamai-sensorv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf The package hides an executable payload inside a block comment in index.js using Unicode variation selectors U+FE00–U+FE0F and U+E0100–U+E01EF...

CVE-2026-9195

Progress MarkLogic Server Query Console is affected by a cross-site scripting (XSS) vulnerability in versions before 11.3.6 and 12.0.3. The issue allows a remote attacker to lure an authenticated administrator to a crafted URL, enabling arbitrary JavaScript execution in the administrator’s browse...

Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

MAL-2026-12661 Malicious code in constructor-blocks-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a...

CVE-2026-71278

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...

CVE-2026-71279

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

MAL-2026-12666 Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

Malicious code in async-mutex-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336 Package name typosquats async-mutex but ships unrelated functionality. The default export getPlugin in index.js issues an HTTP request to a hardcoded...

MAL-2026-12514 Malicious code in async-mutex-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336 Package name typosquats async-mutex but ships unrelated functionality. The default export getPlugin in index.js issues an HTTP request to a hardcoded...

MAL-2026-12799 Malicious code in poly-bbc-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb49d43833628610acae14ea039bb3a490dc94ec90bd8faac084a977a8f8ebd The package's exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

MAL-2026-12338 Malicious code in alpha-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9758eecca0cf755a3c7cc43115b413dfda31f149bbeed40cdfaeb5e46d739efb The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response...

Malicious code in alpha-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9758eecca0cf755a3c7cc43115b413dfda31f149bbeed40cdfaeb5e46d739efb The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response...

Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

Malicious code in npm-module-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026 The default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

MAL-2026-12404 Malicious code in npm-module-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026 The default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

Malicious code in luluking3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays...

Malicious code in cors-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1cff2c95bb175e36d5cb7a6e4880ed0f8816cbfb1dc7acef5d8173cf2cc40bb The CommonJS entry point of [email protected] exposes a getPlugin API that issues an HTTPS GET to the hardcoded host workconfig.vercel.app and pass...