196531 matches found
MAL-2026-16324 Malicious code in better-envforge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...
Malicious code in chai-as-viem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolvi...
MAL-2026-16329 Malicious code in chai-as-viem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolvi...
MAL-2026-16326 Malicious code in byted-commerce-materials (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...
Malicious code in @baanx/solana-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...
MAL-2026-16300 Malicious code in @baanx/solana-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...
MAL-2026-16303 Malicious code in @nimbusedge2/authxsas (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10 The package's package.json declares a preinstall script that fires unconditionally on npm install. The script uses curl to query the cloud instance...
MAL-2026-16309 Malicious code in npmscript_tesstalert_unpkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...
Malicious code in npmscript_tesstalert_unpkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...
CVE-2020-7598
es-define-property Object.defineProperty, but not IE 8's broken one...
MAL-2026-16308 Malicious code in chat-adapter-matrix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...
CVE-2026-45321-Tanstack
供应链攻击模拟 — CVE-2026-45321 TanStack 用于理解 npm 供应链攻击、CI/CD 滥用和安装时代码执行的教育性实验环境 免责声明 本项目仅用于： 网络安全学习， 防御性安全研究， 本地实验模拟， 理解供应链攻击的概念。 请勿将本项目用于： 攻击真实系统， 窃取凭证， 恶意软件部署， 未授权访问， 或其他非法活动。 描述 本实验模拟了该安全事件的基本概念： CVE-2026-45321 TanStack npm 供应链攻陷 GitHub Actions CI/CD 滥用 npm 生命周期脚本执行 模拟在本地安全进行，不会： 真正窃取凭证， 泄露令牌，...
The vulnerability of the require.external component of the vm2 package manager NPM allows a attacker to execute arbitrary code.
The vulnerability of the require.external component in the vm2 package manager NPM is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the crypto.setEngine() function in the vm2 package manager NPM allows a hacker to execute arbitrary code.
The vulnerability of the crypto.setEngine function in the vm2 package manager’s NPM library is related to improper management of processes. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to the disclosure of information in the erroneous data area, allows an intruder to gain unauthorized access to the protected information.
The vulnerability of the NPM packet manager’s library vm2 is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Vulnerability of the node component `sqlite` in the `vm2` package manager of NPM, allowing attackers to execute arbitrary code.
The vulnerability of the node:sqlite component in the vm2 library of the NPM package manager is related to a data protection mechanism breach. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.
The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
The vulnerability of the Promise.prototype.finally() function in the vm2 package manager of NPM allows a attacker to execute arbitrary code.
The vulnerability of the Promise.prototype.finally function in the vm2 package manager of NPM is related to a data protection mechanism flaw. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...
The vulnerabilities of the `Buffer.from()` and `Buffer.concat()` functions in the `vm2` library from the NPM package manager allow a malicious actor to gain unauthorized access to protected information and cause service failures.
The vulnerabilities of the Buffer.from and Buffer.concat functions in the vm2 library from the NPM package manager are related to information disclosure. Exploiting these vulnerabilities could allow an attacker to gain unauthorized access to protected information and cause service failures...
The vulnerability of the command-line interface of the vm2 package manager NPM allows a hacker to execute arbitrary code.
The vulnerability of the command-line interface of the NPM package manager’s vm2 library is related to initialization errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...