Malicious code in delivery-ci-core (npm)

Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in @vertexa/prisma-fetch-engine (npm)

Source: amazon-inspector af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled ' @prisma/fetch-engine', author 'Tim Suchanek ', homepage https://www.prisma.io, bug URL...

Malicious code in dolyame-ui-tabsblock (npm)

Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g. "oob-worker.c","f102-baf",".wor","kers",".dev".join"" and fetch an opaque...

Malicious code in dolyame-boxy-independent-bnpl-breadcrumbs (npm)

Source: amazon-inspector 95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f index.js unconditionally requires./init at module load time. init.js selects a platform-specific path, fetches an opaque native binary over HTTPS from a rotating set of Cloudflare Workers subdomains whose...

Malicious code in devplatform-zod-wip-api (npm)

Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./vendor on load; vendor.js runs at module load, reassembles...

Malicious code in bigops-storio-schematics (npm)

Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from string-array-obfuscated hostnames reconstructed at runtime...

CVE-2026-70611

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

GHSA-F2R8-JV7C-XQMP Electron: DevTools embedder handler executes arbitrary files via shell open

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

CVE-2026-70611

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

Malicious code in checkout-mobile-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b1a15a2100e63737bf9fdc85ec750761a4e58b07f961d8a5734a6f99626026 On require, index.js loads vendor.js which reconstructs destination hostnames from split string literals e.g...

Malicious code in prokit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92 On require of the package, index.js unconditionally loads helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS...

Malicious code in statist-browser-typed-client-investing.product.loginandauthorization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508b23be5504ec69bf284c9a99bb7840e284c52862e07588b07807ebc4f0d71c index.js unconditionally requires./bridge on load. bridge.js selects a per-OS binary URL from a list of string-split-concealed hosts...

MAL-2026-12246 Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from one of several Cloudflare Workers hosts whose names are...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

PT-2026-68956

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

CVE-2026-70611: Improper Neutralization of Special Elements used in an OS Command

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

PT-2026-68287

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.9 Electron versions prior to 40.9.2 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3 Description The DevTools reveal in file manager action could launch a target file instead of simply...

Malicious code in @toni77777/aora (npm)

Source: amazon-inspector 8566221a9ab9a1cb01b0f23e2af4b140d2e97310701b8c9a8f4bed1481fb22b2 On npm install, scripts/postinstall.js fetches a platform-specific executable from https://github.com/yourusername/aora/releases/download/v0.1.0/, writes it to bin/aora, chmods it 0755, and the package's bin...