MAL-2026-12174 Malicious code in cors-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...

MAL-2026-12308 Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

MAL-2026-12295 Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036 On require of the package's main index.js, support.js reconstructs attacker-controlled hostnames from string-split arrays...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

MAL-2026-12253 Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-fb-rf-add-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788686e9aacdc59ec40f42563a7d9ba5020c75d6c724c8bf59623213b51df780 The package's main entry loads bootstrap.js on require, which downloads a platform-specific executable from string-fragment-obfuscated...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd094a1c3c67af1fc7372e62ed565847fcf26962f3b90e53a5df200390c07a99 On require/import, index.js loads bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded...

MAL-2026-12185 Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

MAL-2026-12186 Malicious code in pfp-forms-insurance-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96 On require'pfp-forms-insurance-health', index.js loads compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloa...

Malicious code in peter-desktop-peter-big-column (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7593cd2f0f03765e6debc06626ee5d771a32e0d7eb579ddca1bfc5ca53bc22e6 On require, index.js loads runtime.js which assembles download hostnames at runtime from split string fragments resolving to...

EUVD-2026-53174

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

MAL-2026-11550 Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

EUVD-2026-52869

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...