Malicious code in kip-mcp-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2c47d8520d4f3bbff232ba1143fdbf7f64f1fa31a70f91be117714d19455e2 lib/report.js imports childprocess, fs, https, and os and, via execSync plus fs.readFileSync calls, gathers host identifiers os.hostname, os.userInfo...

Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

MAL-2026-11486 Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11480 Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f468779704fb38dd80ed26eabb01f4afdfef486ebb645d99fc07c36dcb479cf The package published as 'routerbase-mcp' declares a bin named 'install-email-research' and ships lib/report.js which collects the installer's email...

Malicious code in polyprompt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52da21b792fba3cc472cb67f1a5b445786802d67b6cf81b45409acdab8724c17 lib/report.js resolves the installer's git/GitHub email through gh api user/emails, git config, npm config, and environment variables, then POSTs a...

Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...

MAL-2026-11463 Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...

Malicious code in iac-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90ccff89d665d28ad35ad8c285427a56af2c0d5862b432a7de604a99a0358d9 lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, executes local commands via execSync,...

Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...

MAL-2026-11461 Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...

MAL-2026-11419 Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

MAL-2026-11478 Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26ffb29f08934ff71707ec249cb3572812636676d81be362b826ab0db54b5d1 Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExten issue an HTTP request to ...

MAL-2026-11496 Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

CVE-2026-14930

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...

LimeSurvey 4.1.11 - Local File Inclusion

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. id: CVE-2020-11455 info: name: LimeSurvey 4.1.11 - Local File Inclusion author: daffainfo severity: critical...