Malicious code in ts-toolkit-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49d47be3f5dc16ea70755e0233f46106d3f50d1d5384a4f20c76b91463c9876c The package's main entry defines a getPlugin function that performs an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/112...

Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

CVE-2026-18784

A flaw was found in open62541. A heap-based buffer overflow vulnerability exists in the UAClientreadNodeClassAttribute function. A local attacker could exploit this by performing a specific manipulation, potentially leading to information disclosure, data integrity issues, or a denial of service...

Malicious code in rollup-plugins-polyfills-rode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...

Malicious code in fastify-client-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370379b65a0c7e31b5bf43362a0c1fa1312f9a458a7af9a4a3d95892dc2a6935 index.js the package main defines a getPlugin function that fetches JSON from a hardcoded bare-IP HTTPS endpoint at 31.97.137.157:45000 and compiles...

Malicious code in poly-custom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3263a9e2a986068fafa530a8e6862f9ba41cad05ecbd5b7b91752ca1c5af0c6 The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches...

Malicious code in akamaijs-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in chai-as-rendered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a...

Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

Malicious code in cors-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1cff2c95bb175e36d5cb7a6e4880ed0f8816cbfb1dc7acef5d8173cf2cc40bb The CommonJS entry point of [email protected] exposes a getPlugin API that issues an HTTPS GET to the hardcoded host workconfig.vercel.app and pass...

Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...

Malicious code in table-ui-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c794e6aa19f0ead7b319afcc854048f65b89eb008d40c3d1589591d341e80a3 The package's declared CommonJS main dist/index.js and its./config subpath dist/config.js export an array named HASHES containing base64-encoded IIFE...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

Malicious code in ventrix-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b68f964850d0777c1f3993c52e3b66dc425b02ee82fb33bcd958514f730926 [email protected] ships a loader that, when the package's default getPlugin export is invoked, performs an HTTP request to the hardcoded endpoint...

Malicious code in prokit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92 On require of the package, index.js unconditionally loads helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS...

Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...