Malicious code in dolyame-ui-stepper (npm)

Source: amazon-inspector 25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3 On require'dolyame-ui-stepper', index.js unconditionally loads shim.js, which assembles hostnames from split string fragments resolving to oob-worker.cf101-adf,99-9b3,100-416,103-070.workers.dev, with a...

Malicious code in dolyame-ui-clickable (npm)

Source: amazon-inspector f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe On require of the package, index.js unconditionally loads init.js, which selects a platform-specific endpoint linuxx64, linuxarm64, darwin, win32 and downloads a native binary from a rotating list of anonymo...

Malicious code in dolyame-ui-checkable (npm)

Source: amazon-inspector 6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of Cloudflare workers.dev mirror hosts e.g...

Malicious code in dexalot-docs (npm)

Source: ossf-package-analysis 49e7d1e48c40c5dcc937fed7e2bf1fd9437a3886652c7fa4c6d14181cd5aca86 The OpenSSF Package Analysis project identified 'dexalot-docs' @ 3000.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

Malicious code in devplatform-cli-plugin-test (npm)

Source: amazon-inspector 307cdf72132de0cbce8bbbe7fd65b7c89d9c879fd917ff6a9e06e41ff56d299e On require, runtime.js selects a platform-specific asset, downloads a binary over https.get from hardcoded Cloudflare Workers hosts with a DNS TXT base64 fallback under dl.wel1.ru, writes it to /var/tmp or...

Malicious code in deploy-validate-execute-moon-protected (npm)

The package deploy-validate-execute-moon-protected was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in dependencies-poc (npm)

Source: ossf-package-analysis 2c3ca96aa79b3d1be281fd751a05f4550a914026dcfd52672223bb466cf6e3d6 The OpenSSF Package Analysis project identified 'dependencies-poc' @ 1.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

CVE-2026-86115

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

Malicious code in claims-accounts-lib (npm)

Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated list of Cloudflare-Workers hosts string-concatenated via...

Malicious code in claims-block-visibility (npm)

Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint, downloads a binary from one of several...

Malicious code in chkpkit (npm)

Source: ossf-package-analysis 2abd5e119e59d609551d6fcaf5128bad86491c26cc6b721014c324d54e930a7e The OpenSSF Package Analysis project identified 'chkpkit' @ 99.99.9-9.99 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in chi-short-export-assert-execute (npm)

Source: amazon-inspector 2b9a5aa5e0c64e003069b43ff89f71a2a040569317baf9e7ba44dbaaa4ce5f97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in char-cat-execute-eta-authenticate (npm)

Source: amazon-inspector 9713342fe9737ab1d549067b7de055aba480da58db6bdea8625417cc3c3c0a33 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

AlienVault OSSIM av-centerd RCE (CVE-2014-3804)

Exploits CVE-2014-3804 command injection in the av-centerd updatesysteminfodebianpackage SOAP method. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804 — execute session.""" from future import annotations import r...

PineApp Mail-SeCure test_li_connection RCE

Exploits command injection in PineApp Mail-SeCure via the iptest parameter on /admin/testliconnection.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PineApp Mail-SeCure testliconnection.php RCE — execute session.""" from future import annotations import re...

Atlassian Confluence SSTI RCE (CVE-2023-22527)

Exploits CVE-2023-22527 OGNL injection on /template/aui/text-inline.vm to run arbitrary OS commands via freemarker Execute.exec. Confluence 8.0.0–8.5.3 are affected. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence SSTI / OGNL RCE CVE-2023-22527 — reverse CMD session.""" from...

nostromo nhttpd RCE (CVE-2019-16278)

Exploits CVE-2019-16278 directory traversal in httpverify to invoke /bin/sh on nostromo nhttpd = 1.9.6. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """nostromo nhttpd path traversal RCE CVE-2019-16278 — execute session.""" from future import annotations import ...

MAL-2026-15910 Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

CVE-2026-14673

An untrusted search path vulnerability in PostgreSQL's amcheck module allows a user with EXECUTE privileges to escalate privileges or execute arbitrary code. By setting a malicious search path before invoking an amcheck function, an attacker can hijack execution to run arbitrary SQL functions wit...