MAL-2026-15942 Malicious code in omni-channel-order-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal omni-channel-order-frontend package...

Malicious code in ocfe-tv-subscription-center-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b1dcb639402e9d94a5f6f171e32ed97eb7064f7a557b1f7382bf832a4415ba Package name resembles an internal-scoped name and uses an implausibly high version 9999.0.0 consistent with dependency-confusion targeting. The...

Malicious code in omni-channel-oid-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on npm install. The script collects os.hostname,...

MAL-2026-15939 Malicious code in omni-channel-oid-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on npm install. The script collects os.hostname,...

MAL-2026-15847 Malicious code in fieldbase-webapplication-buildtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c30b72acbc526ba924e071ebefd3bc3a131d6dc29abaa71fa76deab2836345e package.json declares preinstall and install lifecycle scripts that collect the installer's username whoami, hostname, current working directory, and...

MAL-2026-15591 Malicious code in cre-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcc14c964a76dde24165930e971dac9a2a9f36ecae68d596c7bf920cac8e1c29 bin/cli.js collects the current user whoami/os.userInfo, os.hostname, and os.platform and POSTs them, along with URL query parameters carrying the sa...

Malicious code in cre-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcc14c964a76dde24165930e971dac9a2a9f36ecae68d596c7bf920cac8e1c29 bin/cli.js collects the current user whoami/os.userInfo, os.hostname, and os.platform and POSTs them, along with URL query parameters carrying the sa...

Malicious code in generate-schema-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b43ea1e723ebd0c0ef5c4cd564b106089f9b5f9fd119dcac26dc1e130a14bf Package publishes as generate-schema-viem but exposes a bin named generate-schema-ethers a dependency-confusion / typosquat shape against the...

Malicious code in generate-schema-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 794f10449a8a47c4428b68edcff212be94917e229322394e9dda43e4c5b2b2e0 On require/npx invocation, bin/cli.js runs whoami and POSTs the OS username, hostname, platform, and package name as JSON to the hardcoded URL...

MAL-2026-15594 Malicious code in generate-schema-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 794f10449a8a47c4428b68edcff212be94917e229322394e9dda43e4c5b2b2e0 On require/npx invocation, bin/cli.js runs whoami and POSTs the OS username, hostname, platform, and package name as JSON to the hardcoded URL...

Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

Malicious code in @temptation.js/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...

Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

Malicious code in fund-list-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb78208f7aa932298e92a8c241ed970296c567a273fc21013dd83bb7916e81b On npm install, package.json's preinstall hook runs index.js which harvests installer host identifiers — os.hostname, os.userInfo username, local IPv...

MAL-2026-14380 Malicious code in fund-list-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb78208f7aa932298e92a8c241ed970296c567a273fc21013dd83bb7916e81b On npm install, package.json's preinstall hook runs index.js which harvests installer host identifiers — os.hostname, os.userInfo username, local IPv...

Malicious code in fund-portfolio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27ba065e8759299d381ed1c7abd5e7721037b4ea969a384a9e70cfb6bb799e17 Package declares scripts.preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, username, hom...

Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

CVE-2026-12071

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

EUVD-2026-54430

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...