NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...

Authentication Bypass by Primary Weakness

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the ProtocolResponse.url when a custom protocol handler omits...

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-70606

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

MAL-2026-13221 Malicious code in bigops-legacy-telephony-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from...

MAL-2026-13256 Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...

MAL-2026-13135 Malicious code in dolyame-ui-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e On package load, index.js requires./platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-13174 Malicious code in dolyame-ui-popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers...

MAL-2026-13204 Malicious code in dwsai-dwsai-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9ec945df21e9ec2a52fc5dccf5b2d8f734c53aba8c9b6bd14f515c8e4a4fc8 On require'dwsai-dwsai-core', index.js loads adapter.js which downloads a platform-specific binary from author-controlled Cloudflare Workers mirrors...

Malicious code in bigops-watchdog-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7bfa2b0d9464df6662fddb4e969b42ef35465f2c70ba39943ac3fb0265aa781 On require of the package, index.js loads vendor.js which selects a platform-specific URL, downloads an opaque binary from one of several Cloudflare...

MAL-2026-12918 Malicious code in bnpl-blocks-desktop-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a277db0429a37308bb1ce8f4d8f051e7be7b04cf8c327c10b967d9a7b17da75b The package's main entry unconditionally requires support.js, which at load time fetches a platform-specific native binary from obfuscated Cloudflare...

Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1d442b520a1779845bf9dc5d8a0cd822606ec46e0a01850143b93e14658cfe9 On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded .workers.dev endpoint...

Malicious code in boxy-maker-extendable-minihost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4 On require, index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation resolving to oob-worker.cf101-3-.workers.dev...

MAL-2026-13092 Malicious code in boxy-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfb29953971bb0c3eae94e97f7a9efe132bd4a954252ae52c989f990f389d098 index.js unconditionally requires./setup.js on module load. setup.js assembles Cloudflare Workers hostnames from split-string arrays...

Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

MAL-2026-12594 Malicious code in checkout-subscription-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join""...

Malicious code in checkout-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909 On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays e.g...