meesho-android-improper-encryption-cve-2026-5682

🔐 Prueba de Concepto: Aplicación Android de Meesho – Implementación Criptográfica Insegura AES-CBC sin Integridad + Derivación de Clave Débil Autor: Soyam Arya alias honestcorrupt Fecha de Descubrimiento: Marzo 2026 Aplicación Afectada: Aplicación Android de Meesho com.meesho.supply Estado: En...

CVE-2026-78574

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

MAL-2026-15520 Malicious code in ring-device-settings-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3ea2aed3d7e8c0b9c99532d6714c486a5ad685418ebbd96c67b44b63f79fe01 package.json declares a dependency whose key equals the package's own name ring-device-settings-library and whose value is a raw HTTPS URL pointing a...

Malicious code in integration-amplitude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd9ffdf0c07f64af4034ec76aea284a6290f4633f2c80eefa65579c1a297bfb package.json declares the package's own name as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/integration-amplitude...

MAL-2026-15510 Malicious code in integration-amplitude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd9ffdf0c07f64af4034ec76aea284a6290f4633f2c80eefa65579c1a297bfb package.json declares the package's own name as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/integration-amplitude...

CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

EUVD-2026-63086

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

PT-2026-78701

Name of the Vulnerable Software and Affected Versions mce-operator-bundle affected versions not specified Description The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning fixing a specific version of a commit or...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...

Malicious code in bigops-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80be948322937758b568e63d82d769aa07a443a3b849cf19fd440ed5bf4505ec On require'bigops-tasks', index.js side-effect loads vendor.js which downloads a platform-specific native binary from string-fragment-obfuscated...

MAL-2026-12873 Malicious code in bnpl-blocks-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4990414fbbea6c3a7c19539ac76eeee019ae4657756545743b4b54bdece4a135 Requiring the package's main entry transitively loads init.js, which selects an OS/architecture-specific endpoint and downloads a binary from one of...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12763 Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

MAL-2026-12458 Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...