Malicious code in dolyame-ui-popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7 On require of the package, index.js loads./polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at...

MAL-2026-13189 Malicious code in dolyame-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev,...

MAL-2026-13183 Malicious code in dolyame-ui-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 340d04c991fde57848574728e622b6f4c3b1d2e7dcd061e590c4da91bbc6f12d Package advertises itself as a visual/UI components library but ships a load-time binary dropper. index.js unconditionally requires./vendor.js, which...

Malicious code in dolyame-ui-stepper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3 On require'dolyame-ui-stepper', index.js unconditionally loads shim.js, which assembles hostnames from split string fragments resolving to...

Malicious code in dolyame-ui-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of...

Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

MAL-2026-12822 Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

MAL-2026-12823 Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

MAL-2026-12828 Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

Ghost Content API filter bypass reveals private fields

Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes'...

MAL-2026-13107 Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...

Malicious code in ded-aa-liza-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a328f8fbefe24a810c8fe1c0249029992137bec024cab060df03d88347b5185b On require of this package, index.js loads helpers.js which downloads a per-platform native executable linuxx64, linuxarm64, darwin, win32 from...

Malicious code in delivery-ci-quality (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a7deac8b6933e5d38da84c365f65ac4fbcf7b3a26825914d19ca7aeafcf516 On require of the package, index.js unconditionally loads compat.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers...

AZL-94661 CVE-2026-71227 affecting package libkcapi for versions less than 1.5.1-1

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-71227 Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader

A flaw was found in zlib, a Ruby interface for the zlib compression/decompression library. The Zlib::GzipReader component contains a buffer overflow vulnerability. This occurs because the zstreambufferungets function does not ensure sufficient memory capacity before moving existing data, which ca...