MAL-2026-13540 Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints...

MAL-2026-13555 Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

MAL-2026-13531 Malicious code in damir-cbr-dawdntrnssbf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts...

Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

MAL-2026-13568 Malicious code in dolyame-ui-eventoutside (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Worke...

MAL-2026-13521 Malicious code in @rbxst/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e349df2092cb3672698c00cefa5268881f21a60d1f71394c9e223b40d086d2 scripts/postinstall.js runs at npm install time. On Windows it downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip anonymous file-hostin...

Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

Malicious code in bigops-abstract-entity-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 294402f19750cb519f7bdcf28e24e057513e0fc59cbfa4bc8e24a39b93832351 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific asset path, downloads bytes from a rotating list of...

Malicious code in dolyame-ui-inputtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5 On require'dolyame-ui-inputtime', index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-ui-overridestyles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

MAL-2026-13550 Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0 On require of the package, index.js loads bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from...

Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

CVE-2026-56848

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing. Mitigation Restrict netwo...

ROOT-APP-NPM-CVE-2023-26144 CVE-2023-26144 in graphql - Patched by Root

Root has patched CVE-2023-26144 in the graphql package for Root:npm. Multiple fixed versions available...

CVE-2026-71430

A flaw was found in node-re2, a library providing RE2 regular expression bindings for Node.js. When performing a global string replacement with a specially crafted template that amplifies the output, the resulting string can exceed the maximum length allowed by the V8 JavaScript engine. This...

Malicious code in @junyoung-kim/reins (npm)

Source: amazon-inspector a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475 The reins CLI spawns a local pseudo-terminal via node-pty default /bin/bash or cmd.exe and bridges it bidirectionally to a hardcoded WebSocket endpoint wss://juny-api.kr/relay, with pairing coordinated throu...

Malicious code in rdfxvela-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef19b46ba2f8a9d7a30bedb44d2e45903d5e4e905d736b5ce5c20cbb0b77be12 The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-time code fetch and execution...