Malicious Package

Overview cordova-plugin-geofence-appit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview appit-cordova-plugin-ionic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-18256 Malicious code in cordova-plugin-geofence-appit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in appit-cordova-plugin-ionic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cordova-plugin-geofence-appit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in appit-cordova-plugin-ionic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cordova-plugin-geofence-appit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18254 Malicious code in appit-cordova-plugin-ionic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cordova-plugin-ooyala (npm)

The package cordova-plugin-ooyala was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-devextremeaddon (npm)

The package cordova-plugin-devextremeaddon was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-zendesk (npm)

--- Credit: OpenSSF source...

Malicious code in cordova-plugin-devextremeaddon1 (npm)

The package cordova-plugin-devextremeaddon1 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-secrets (npm)

The package cordova-plugin-secrets was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-wifi-monitoring (npm)

The package cordova-plugin-wifi-monitoring was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-onyxbeacon (npm)

The package cordova-plugin-onyxbeacon was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-ios-no-export-compliance (npm)

The package cordova-plugin-ios-no-export-compliance was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cordova-plugin-firebase-lovespace (npm)

The package cordova-plugin-firebase-lovespace was found to contain malicious code. --- Credit: OpenSSF source...

@omneedia/client-js (>=2.0.1, <=2.1.1), @omneedia/ssr (0.0.2) +9 more potentially affected by CVE-2026-47430 via cordova-plugin-inappbrowser (>=3.2.0, <=5.0.0)

cordova-plugin-inappbrowser NPM version =3.2.0, =2.0.1, =0.5.72, =1.0.0-rc.3, =2.1.2, =0.0.1, =0.2.5, =0.2.7 - poad 2.1.1 - things-factory-on-tv 2.0.0 Source cves: CVE-2026-47430 Source advisory: SNYK:JS-CORDOVAPLUGININAPPBROWSER-17337040...

CVE-2026-47430

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

CVE-2026-47430

Summary The iOS implementation of "cordova-plugin-inappbrowser" passes the "id" field from a "WKScriptMessage" body to "commandDelegate sendPluginResult:callbackId:" with no format validation "CDVWKInAppBrowser.m:560–574". Any web content loaded inside the InAppBrowser can fire any pending Cordov...