MAL-2026-12686 Malicious code in delivery-ci-upgrade-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64,...

Malicious code in delivery-ci-upgrade-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64,...

MAL-2026-12681 Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12693 Malicious code in devplatform-api-v1-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ed0defa1fbae571985664baae47d89d796f943b249115eb73a38edce04fb6c On require, adapter.js selects a platform-specific asset path and fetches an executable from string-split-obfuscated hosts under...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12373 Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-12375 Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

claudit

claudit – AI-based code security auditing tool claudit is an...

MAL-2026-12301 Malicious code in twork-data-services-sme-agent-company-relation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967bdfae105295a824e45402395d3b82a515d225081bc94f4d5998b2884df38 index.js unconditionally requires./init on module load. init.js assembles host names at runtime via array join to hide them from static scanners, the...

Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12286 Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

Malicious code in tinkoff-statist-browser-typed-client-sme.users.origination.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bfbb507be06c5d117ac6bfdff47a2441c2198b0d5702e4da97f598bc0d880a3 The package's main entry require's loader.js, which at import time downloads a per-platform binary from string-concatenation-obfuscated Cloudflare...

MAL-2026-12251 Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

MAL-2026-12156 Malicious code in bigops-chat-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8d11b7e8abee5caddc5c2f1765fa7f10d40c8cce0ef1cafed55fe31537be94 On require of bigops-chat-transfer, platform.js reconstructs one of three Cloudflare workers.dev hostnames from split string fragments...

Malicious code in bigops-info-notices (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...

MAL-2026-12170 Malicious code in bigops-info-notices (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition through the AMQP 1.0 disposition processing in Session10 and the delivery registry. An authenticated attacker can exhaust CPU by sending a disposition frame with a large or illegal delivery range, whic...