Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

MAL-2026-13121 Malicious code in bpm-foundation-test-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319 On require of the package, index.js loads bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments...

MAL-2026-12523 Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

Malicious code in checkout-desktop-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67636a6aeed1ed70d1bfd731fb8a845f67279b3afa82aa45b8e7a8ac9fe41cee On require of this package, index.js loads bootstrap.js which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

CVE-2026-17613 CVE-2026-17613

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

CVE-2026-17613 CVE-2026-17613

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

CVE-2026-17613

The Penpot application contains a vulnerability in the ::import-binfile RPC command due to a lack of authorization on the optional file-id parameter. This flaw allows any authenticated user to overwrite arbitrary files on the target server and subscribe to WebSocket events. The practical conseque...

EUVD-2026-53386

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

MAL-2026-12600 Malicious code in checkout-use-boolean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts...

Malicious code in checkout-use-boolean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts...

Malicious code in claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484891b513be8a69a5292810c211fd31bf54ad2a32c6f4899faafb1e7d31ef7e On require of claims-api-adapters, index.js unconditionally loads init.js, which invokes bootstrap at top level. bootstrap selects a platform-specifi...

Malicious code in claims-create-client-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9da539004d6a9ae666f733556ea55cc9ec81bd01efb27810f72f388cedcfc1d1 On require'claims-create-client-validator', index.js loads vendor.js whose top-level bootstrap fetches an OS/arch-specific native binary over HTTPS...

MAL-2026-12624 Malicious code in claims-historical-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997 index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments e.g...

MAL-2026-12633 Malicious code in claims-payout-offer-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers...

Malicious code in claims-payout-offer-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers...

Malicious code in cobrowsing-decorators (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...

MAL-2026-12665 Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...