Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12721 Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12735 Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

ROOT-APP-NPM-GHSA-VVJJ-XCJG-GR5G GHSA-vvjj-xcjg-gr5g in nodemailer - Patched by Root

Root has patched GHSA-vvjj-xcjg-gr5g in the nodemailer package for Root:npm. Multiple fixed versions available...

CVE-2026-71269

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

Malicious code in poly-provider-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef76fc9ad34b0c2f608bd61904deec5355ffe02b045eecf233e70e989ce0260 No a static rule matches were produced for this package version, and traced-code findings are not available in a parseable form. The package's actual...

MAL-2026-13385 Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

MAL-2026-12358 Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

CVE-2026-18784

A flaw was found in open62541. A heap-based buffer overflow vulnerability exists in the UAClientreadNodeClassAttribute function. A local attacker could exploit this by performing a specific manipulation, potentially leading to information disclosure, data integrity issues, or a denial of service...

Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

MAL-2026-12334 Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...