Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...

Malicious code in boxy-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1164ada14e000c3802b5766cdd31ef169e8f15a6d132cbe52d88b0c593b03c2a On require of the package, bridge.js downloads a platform-specific binary from obfuscated Cloudflare workers.dev hosts...

Malicious code in boxy-maker-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14 On require, index.js loads shim.js, which selects a platform-specific asset, downloads a binary over HTTPS from a randomized list of Cloudflare Worke...

Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

Malicious code in boxy-test-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2ce2597c942a6017ba1aad05cadffba71e6673f8ae9298ef589493e3c4e5ad3 On require'boxy-test-block', index.js loads compat.js which reconstructs attacker-controlled destination hosts via string-split obfuscation...

Directory Traversal

Overview @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Directory Traversal through the HostedPluginReader in plugin-reader, specifically the /hostedPlugin/:pluginId/:path resource handler. An attacker can read arbitrary files accessible to the...

MAL-2026-12522 Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

MAL-2026-12529 Malicious code in cardsmobile-cardsmobile-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30 On require of cardsmobile-cardsmobile-core, index.js loads shim.js which selects a platform-specific payload path, fetches an unsigned executable fro...

MAL-2026-12530 Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...

MAL-2026-12541 Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12544 Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in checkout-get-pos-documents-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098 On any require/import of checkout-get-pos-documents-am, index.js loads compat.js, which selects a per-platform binary linuxx64, linuxarm64, darwin,...

CVE-2026-17613

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

Malicious code in checkout-mobile-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4 [email protected] executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary UR...

Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

MAL-2026-12585 Malicious code in checkout-pay-widget-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-12596 Malicious code in checkout-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloa...