MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

MAL-2026-12051 Malicious code in tinkoff-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembl...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-62324 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-62324 Source advisory: OSV:GHSA-J839-GQQ4-GF9J...

CVE-2026-41679

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration...

Malicious Package

Overview react-ui-polyfills is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in react-ui-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63c43460df1ee670b8a5982d77e7028aef7df25fa38922f743489fd52b41b5ea Package advertises itself as React polyfills / UI compatibility helpers but ships no React or polyfill code. The exported getPlugin function returns ...

MAL-2026-3270 Malicious code in @bcs-react-ui/select (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f13a9b44b9cd000d9cc8fbcd4cbc765178ea32a471cd8b339d4ebdda4182d52 The package @bcs-react-ui/select was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3269 Malicious code in @bcs-react-ui/context-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d7735468c4f2cdf66767c4b52a6a089b195ea5bb820b82a03690fb0c9586bc The package @bcs-react-ui/context-menu was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3267 Malicious code in @bcs-bank-react-ui/swiper-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecc6cabd59042f5fc22327d81efedc2ed1926f8f9457d124906fde72fbf65d46 The package @bcs-bank-react-ui/swiper-slider was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-3084

Malicious code in bve-react-ui-kit npm...

Malicious code in bve-react-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7129addcf662b66f1b9c3bccfef1b910ba7d7529205773a6ef69f5fcec9b9178 The package bve-react-ui-kit was found to contain malicious code. Source: ghsa-malware e12ba9c2363df47acb928246ccbbfedb85b5cbfb0f433286818034daf65dfd...

MAL-2026-271 Malicious code in bve-react-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7129addcf662b66f1b9c3bccfef1b910ba7d7529205773a6ef69f5fcec9b9178 The package bve-react-ui-kit was found to contain malicious code. Source: ghsa-malware e12ba9c2363df47acb928246ccbbfedb85b5cbfb0f433286818034daf65dfd...

Malicious Package

Overview wfui-dbd-react-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview wfui-dsm-react-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-200281

Malicious code in wfui-dbd-react-ui npm...

MAL-2025-191668 Malicious code in wfui-dbd-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49a931af71a32dfa7644c29cca564d41bd857fa8cdea4956e0764cd224834ad The package wfui-dbd-react-ui was found to contain malicious code. Source: ghsa-malware...

Malicious code in wfui-dbd-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49a931af71a32dfa7644c29cca564d41bd857fa8cdea4956e0764cd224834ad The package wfui-dbd-react-ui was found to contain malicious code. Source: ghsa-malware...

Malicious code in wfui-dsm-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab7eb463079033f35833ad6226f3db96e8b3e17ed382e0868d2ad823af5bb34 The package wfui-dsm-react-ui was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-200282

Malicious code in wfui-dsm-react-ui npm...

MAL-2025-191669 Malicious code in wfui-dsm-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab7eb463079033f35833ad6226f3db96e8b3e17ed382e0868d2ad823af5bb34 The package wfui-dsm-react-ui was found to contain malicious code. Source: ghsa-malware...