156 matches found
Malicious code in react-scroll-disable (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa On require of react-scroll-disable, the package's main entry executes an evalatob... blob appended after the legitimate RemoveScroll export. The blob...
Malicious code in tailwind-animationpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3 src/index.js appends an obfuscated evalatob... block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and...
MAL-2026-12219 Malicious code in tailwind-animationgroup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...
Malicious code in devpack-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...
MAL-2026-12177 Malicious code in devpack-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...
MAL-2026-12116 Malicious code in tailwind-hide-scrollbar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...
Malicious code in uibabai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484 index.js has malicious code appended after a legitimate Tailwind plugin export. On any require/import of the package, the appended block queries the...
GHSA-6H5J-32CF-4253 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Summary apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck causes this to bypass authorization on all piece-type REST API endpoint...
MAL-2026-11146 Malicious code in sigchain-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...
Malicious code in chain-analyze (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...
Malicious code in chai-as-predicted (npm)
Source: amazon-inspector fd7a2ff71dd341d02986c8185ea9eb18196b782f0efd9103859c0493c9f4cc78 Package name 'chai-as-predicted' impersonates the popular 'chai-as-promised' assertion library, but ships unrelated code disguised as pino logger internals. The exported middleware in index.js spawns a...
Malicious code in lovable-tager (npm)
Source: amazon-inspector 0f100c9dbac6f2e352e559d0eb06f573e971845cc083b80c61f211013e03973a lovable-tager is a single-character-deletion typosquat of the legitimate Vite plugin lovable-tagger. The ESM entry dist/index.js referenced by main contains the clean plugin code followed by 6 KB of tab...
Malicious code in chain-guardian (npm)
Source: amazon-inspector 1c281292766d55cda3ff1b006154150aa05d567a4f8115534788ffbbc014f3e7 chain-guardian presents itself as a mocha gas reporter typosquatting eth-gas-reporter but its main entry index.js contains an always-true gate var opt = 1; if !opt ... else ... that forces construction of th...
Malicious code in gamified-trading-system (npm)
Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those APIs. The only meaningful exports are setDefaultModule an...
Malicious code in chai-guid (npm)
Source: amazon-inspector 69e9bcacf8dca52aafe4d93019b888c6d32e344b500a21368f036bf586eee161 chai-guid impersonates the pino logger and the chai-guid chai plugin README copies pino badges and pinojs CI links; index.js exports middleware as module.exports.pino. When a consumer calls the exported...
GHSA-MH99-V99M-4GVG brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
Summary expand bounds the number of results it produces the max option, 100000 by default but not their length. By chaining many brace groups, an attacker keeps the result count under max while making every result grow with the number of groups. Building max long results — plus the intermediate...
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
Summary expand bounds the number of results it produces the max option, 100000 by default but not their length. By chaining many brace groups, an attacker keeps the result count under max while making every result grow with the number of groups. Building max long results — plus the intermediate...
GHSA-WQJV-9729-C5Q2 SvelteKit: Big remote form function payloads can cause Node process to crash
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS...
SvelteKit: Big remote form function payloads can cause Node process to crash
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS...
CVE-2026-54335
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by...