MAL-2026-12160 Malicious code in bigops-cobrowsing-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25ce2f0f7a7411a7bfedb5d07449d26620388d3936e5951883e52463de01ef50 On require of this package, index.js loads shim.js which triggers an async payload that fetches a platform-specific binary from obfuscated Cloudflare...

Malicious code in bigops-data-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0 On require of bigops-data-storage, index.js loads compat.js which unconditionally runs a top-level routine that downloads a native executable from...

MAL-2026-12163 Malicious code in bigops-data-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0 On require of bigops-data-storage, index.js loads compat.js which unconditionally runs a top-level routine that downloads a native executable from...

MAL-2026-12151 Malicious code in bigops-auth-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 018aa5e99b7e6aa9f438b51ee00164801a2eb1c52e78ad123d0c490dced4b67c On require of [email protected], index.js loads vendor.js which selects a platform-specific binary URL, downloads bytes over HTTPS from...

MAL-2026-12165 Malicious code in bigops-external-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5 On require'bigops-external-auth', index.js loads adapter.js which downloads a platform-specific native binary from Cloudflare Worker hosts whose...

Malicious code in bigops-info-notices (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...

Malicious code in bigops-chats-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69 On require of the package, index.js loads init.js which performs OS/arch detection, downloads a native binary from hardcoded Cloudflare Workers...

MAL-2026-12092 Malicious code in @wethenorth12/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8 @wethenorth12/[email protected] is a typosquat of the ethers package package name, description, and author string 'ricmoo' all mimic the real package;...

Malicious code in @wethenorth12/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da index.js runs at require time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes...

Malicious code in tailwind-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...

MAL-2026-12116 Malicious code in tailwind-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...

MAL-2026-12114 Malicious code in streak-calc-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7 [email protected] bundles a Linux x8664 ELF at dist/math-calc.bin and launches it unconditionally when the package is imported. The top-level II...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

MAL-2026-12079 Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

Malicious code in beaver-ui-card-large (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2 Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap on process.nextTick so the paylo...

Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

MAL-2026-12063 Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

MAL-2026-12061 Malicious code in bigops-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a2b7c0da202027f856d059a571a04e01fd992845a158dcd01dfcd1bea4000bb The package advertises itself as an eslint helper but, on require of index.js, unconditionally loads helpers.js which fetches an OS-specific executab...

Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...