Arbitrary Code Execution

Faker is vulnerable to Arbitrary Code Execution. The vulnerability is due to attacker-controlled fake templates accessing the Function constructor through fakeEval.resolveProperty, which allows an attacker to execute arbitrary JavaScript code...

EUVD-2026-56923

Faker: helpers.fake exploitable into arbritary code execution...

Malicious code in alpha-helper (npm)

Source: amazon-inspector 9758eecca0cf755a3c7cc43115b413dfda31f149bbeed40cdfaeb5e46d739efb The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response field data.credits into a new Function... constructor with...

MAL-2026-15554 Malicious code in eth-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e08c035ca41519f1d57d389027befac80a8ee8405612825b633967db5fb8c1 On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to...

Malicious code in solidity-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8 Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns...

Malicious code in hatdhat-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83b6e58e31221d5d14386a193ab49381950bb01307ac4fb4d7e5c30d246046d9 Package presents itself as a pino-style logging utility but its middleware entrypoint index.js spawns lib/caller.js as a detached Node process...

MAL-2026-14373 Malicious code in hatdhat-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83b6e58e31221d5d14386a193ab49381950bb01307ac4fb4d7e5c30d246046d9 Package presents itself as a pino-style logging utility but its middleware entrypoint index.js spawns lib/caller.js as a detached Node process...

Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

Malicious code in express-route-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d On require/import, index.js immediately invokes an initializer that HTTP-GETs a JSON document from...

Malicious code in x6842179305 (npm)

Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an opaque payload to execute whenever the module is required or...

Malicious code in x6842179305 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an...

MAL-2026-14303 Malicious code in x6842179305 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an...

Malicious code in rand-txs-sdk (npm)

Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload. loadtransactiondata reads per-record 'mark' strings from...

Malicious code in txs-lib-sdk (npm)

Source: amazon-inspector 5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5 The package's advertised getTransactions API invokes an internal loader that reads database.js — a file disguised as a product catalog — extracts each record's mark field, base64-decodes it and applies a...

MAL-2026-14193 Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...

Malicious code in bootstrap-custom-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded...

MAL-2026-14030 Malicious code in bootstrap-custom-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded...

CVE-2026-73231

A flaw was found in Faker, a library for generating fake data. The faker.helpers.fake method allows an attacker to control fake templates, which can then access the Function constructor. This access, specifically through fakeEval.resolveProperty when a function returns another function, enables...

CVE-2026-73649

Velocity.js (Java) details: In versions prior to 2.1.7, an existing fix for CVE-2026-44966 protected only the #set assignment target, while property-read expressions in src/compile/references.ts were not filtered. The getReferences() flow could reach getAttributes() and allow a crafted template t...

CVE-2026-73649 Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...