CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70604

In Electron, a vulnerability affects custom schemes registered with supportFetchAPI: true but without corsEnabled: true. Prior to versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0, such schemes were not subject to CORS enforcement, allowing a page loaded from a remote origin to fetch() or XMLHttpReque...

MAL-2026-13252 Malicious code in bigops-storio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...

MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

MAL-2026-13307 Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembl...

MAL-2026-13302 Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

MAL-2026-13306 Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in devplatform-spa-plugin-s3-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflar...

Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

MAL-2026-12823 Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

Malicious code in bigops-tcrm-identity-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183fa24523e19286718ff854ed8d080c8d8635d6d914a3fbb871c388660fc479 [email protected] is a dropper disguised as a session-management utility. Its main entry index.js requires bootstrap.js on load, which...

Malicious code in bigops-ui-kit-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1 On require of bigops-ui-kit-styles, index.js loads compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomai...

Malicious code in bigops-web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ba471d08385d30965c87d85316db28f34e4cd5f6f5eb20f5f9cedc33cd12bf On require, index.js loads helpers.js which selects a platform-specific endpoint and fetches an opaque binary payload from string-split-obfuscated...

MAL-2026-12858 Malicious code in bigops-web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ba471d08385d30965c87d85316db28f34e4cd5f6f5eb20f5f9cedc33cd12bf On require, index.js loads helpers.js which selects a platform-specific endpoint and fetches an opaque binary payload from string-split-obfuscated...

MAL-2026-12872 Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9 index.js unconditionally requires./support at package load. support.js reconstructs a list of Cloudflare Workers hostnames...

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...