Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

MAL-2026-13497 Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

MAL-2026-12675 Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

Malicious code in tinkoff-pwa-confac-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d The package advertises itself as a types interface but its main entry silently requires adapter.js inside a try/catch. On require, adapter.js assembl...

phone-deck v3.0.1

phone-deck Turn a spare Android phone or any device with a browser into a self-hosted control deck and remote desktop for your Linux workstation — over your private Tailscale network, with no third-party apps. It started as "what do I do with an old phone?" and became a control plane for a Hyprla...

Malicious code in vite-pwa-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab1e251883a8eceecc27c935ed05352375d438c1efbbd8727f2b13a766409d0 Package vite-pwa-config impersonates the popular vite-plugin-pwa antfu — the README instructs users to import configJson from vite-plugin-pwa, and...

Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

MAL-2026-6969 Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

Malicious Package

Overview vite-json-pwa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-54352

Budibase has a high-severity arcane file-read issue via the PWA ZIP upload endpoint. Prior to 3.39.9, a workspace-builder could upload a ZIP containing a symlink to a root-available file (for example, /data/.env or /etc/shadow) and, because extract-zip preserves absolute targets and the icon vali...

CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

Malicious code in vite-config-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e5dabbc9cf746e153391fbe76f4dc54f9bccb9f7fd467d5b80d07c84ab1fb58 [email protected] impersonates the legitimate vite-plugin-pwa package README copies its banner/badges, funding field points at antfu's GitHub...

signal-echo-radar

Signal Echo Radar Signal Echo Radar is a static cybersecurity...

Linux Distros Unpatched Vulnerability : CVE-2026-5892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5892

Google Chrome versions prior to 147.0.7727.55 are vulnerable to insufficient policy enforcement in Progressive Web App (PWA) implementations. A remote attacker who has already compromised the renderer process can exploit this flaw to install arbitrary PWAs without user consent via a crafted HTML ...

CVE-2026-5892: Policy Privileges are not Assigned Consistently Between Control and Data Agents

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

Malicious Package

Overview shakti-pwa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in shakti-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdac10e664bf4e0a73263401629caf12d2ed80e3cf76f36fa18a7c2d599e5229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...