MAL-2026-12280 Malicious code in tinkoff-terminal-kit-datetime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ff5d079ddd6e9ef6bd552f3a33ec5d0c87dcad3dce14013cbf28cbaa37a1dc1 The package's main index.js unconditionally requires runtime.js, which on any require/import selects a platform-specific endpoint and downloads an...

MAL-2026-12142 Malicious code in beaver-ui-ai-chat-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809 Package is advertised as a UI chat layout toolkit but its index.js unconditionally requires a setup.js that side-loads a 77 KB module internally...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

MAL-2026-12177 Malicious code in devpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...

Malicious code in devpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

Malicious code in bigops-data-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0 On require of bigops-data-storage, index.js loads compat.js which unconditionally runs a top-level routine that downloads a native executable from...

MAL-2026-12168 Malicious code in bigops-frontend-bigops-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb3c97636fded3935088ac125f923882844470f5638c45176b4254d4dbad714 On require of the package, vendor.js downloads a platform-selected native binary from hardcoded Cloudflare Workers hosts...

Malicious code in bigops-chats (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 322310cb37baed38193c12087a25e40901a781467fc070c1bf078293ca8586be On require of bigops-chats, index.js loads helpers.js which assembles C2 hostnames via array split-join obfuscation oob-worker.cf101-adf.workers.dev,...

Malicious code in bigops-auth-provider-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7 On require, bigops-auth-provider-interceptor loads init.js, which reconstructs destination hostnames via string-split/join...

MAL-2026-12152 Malicious code in bigops-auth-provider-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7 On require, bigops-auth-provider-interceptor loads init.js, which reconstructs destination hostnames via string-split/join...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources by sending specially crafted requests prior to authentication. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources and cause a denial of service by sending specially crafted requests prior to authentication...

CVE-2026-71202 raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...

EUVD-2026-53184

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

MAL-2026-12089 Malicious code in @wethenorth12/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56f2c55cacbd8d06b8d3b0f20b808262c42cd002441399d8e39a2f03c600f3c On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and POSTs it to...

Malicious code in @wethenorth12/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...

Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...

Malicious code in @wethenorth12/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8 The package presents itself as a drop-in replacement for the ethers library author metadata ethers-io, repository URL pointing at the legitimate ethe...