@appweaver/core (>=1.0.8, <=1.4.1), @buildplease/apikit (>=1.0.0, <=1.0.1) +15 more potentially affected by CVE-2026-18549 via @fastify/multipart (>=10.0.0, <=10.1.0)

@fastify/multipart NPM version =10.0.0, =1.0.8, =1.0.0, =4.0.1, =5.3.0, =0.0.17, =2.5.0, =2.2.1, =20260128.2248.28, =20260411.1248.30, =20260828.1636.54, =1.0.1, =0.11.0, =0.0.0-unstable.9f53ea597d, =5.21.1-beta.15, =6.0.1-alpha.2 and more Source cves: CVE-2026-18549 Source advisory:...

MAL-2026-14064 Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

Malicious code in adxaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing...

Malicious code in @openrepl/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fcd297122e7aac00cd0d3d92fcb5f1fc00b6c558571a037b5447eb64bd443b8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js shells out via childprocess to execute curl -X...

Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...

Malicious code in hunterone-build-probe-9210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e probe.js runs automatically via package.json preinstall and postinstall hooks "node probe.js || true". On execution it collects os.hostname,...

MAL-2026-14062 Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

Malicious code in autbank-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d On npm install, preinstall.js enumerates process.env for keys matching credential substrings KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH...

MAL-2026-14056 Malicious code in gunzip-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...

Malicious code in gunzip-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...

Malicious code in depcruise-fmt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...

Malicious code in depcruise-baseline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...

MAL-2026-14053 Malicious code in depcruise-baseline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...

MAL-2026-14054 Malicious code in depcruise-fmt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...

Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

CVE-2026-18165

creationtimestamp| type| source ---|---|--- 2026-08-15 13:48:50+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mt4st6feps2i...

Malicious code in require-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...