Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

MAL-2026-17161 Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

MAL-2026-17158 Malicious code in simple-date-formatter-new-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...

Malicious code in simple-date-formatter-new-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...

Malicious Package

Overview blue-string-formatter-utilss is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in blue-string-formatter-utilss (npm)

Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element with src='https://xss.report/c/k3rne111' and appends it t...

Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

MAL-2026-16363 Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

Malicious code in blue-string-formatter-utils (npm)

Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET to the protocol-relative URL //xss.report/c/k3rne111 whose...

Malicious Package

Overview blue-string-formatter-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in blue-string-formatter-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...

MAL-2026-16273 Malicious code in blue-string-formatter-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...

PT-2026-94562

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC xilinx formatter pcm component where stream data is leaked during an open error. In the xlnx formatter pcm open function, stream data is allocated and assigne...

CVE-2026-81898

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

EUVD-2026-57222

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags...

Malware in date-fns-formatter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-15974 Malicious code in date-fns-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450 The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front o...

Malicious code in date-fns-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450 The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front o...

Malicious Package

Overview date-fns-formatter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-63219

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .x...