Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...

MAL-2026-12453 Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

CVE-2026-71269

CVE-2026-71269 affects Node-RED’s local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js). The vulnerability arises because GET/POST requests to /library/:lib/:type/*path join the user-sup...

CVE-2026-71269 Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-71269 Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

EUVD-2026-53354

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-71269

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

Malicious code in aegis-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66d1f02c3c943836d41a7ec92c150c5529880890a4cc502115412dddb0c519c The package's declared postinstall hook runs node src/test.js, which issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate...

Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534768cd8d709ca1a5701f182e4e509713821923b6995a2bb868d79b0fdded62 On require of the package index.js loads./vendor at import, vendor.js selects a platform-specific staging path, downloads a binary from a rotated lis...

CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

ROOT-APP-NPM-CVE-2016-20018 CVE-2016-20018 in knex - Patched by Root

Root has patched CVE-2016-20018 in the knex package for Root:npm. Multiple fixed versions available...

MAL-2026-12188 Malicious code in pfp-integration-mobile-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170 On require of the package, bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of...

Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12224 Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...