Malicious code in carbon-monorepo (npm)

Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets — os.hostname, full process.env, platform/arch, cwd,...

Malicious code in nice-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c88734e4d701b61fd197a942bc057f59c684d4eb9994ca0efc7136dfcf893c9 The npm package [email protected] executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud...

MAL-2026-14248 Malicious code in nice-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c88734e4d701b61fd197a942bc057f59c684d4eb9994ca0efc7136dfcf893c9 The npm package [email protected] executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud...

Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in code-assist-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 093f28fd5542ee841027c5b3dc6917a42ac13dd3e0e1d3bf334e87b823886d3c [email protected] runs a postinstall lifecycle script that collects host identifiers hostname, platform, arch, Node version, package name and POS...

MAL-2026-14233 Malicious code in code-assist-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 093f28fd5542ee841027c5b3dc6917a42ac13dd3e0e1d3bf334e87b823886d3c [email protected] runs a postinstall lifecycle script that collects host identifiers hostname, platform, arch, Node version, package name and POS...

MAL-2026-14229 Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

Malicious code in tfjs-custom-module (npm)

Source: amazon-inspector c50d87a4593cb5a0444f2333f368180b64dfb5d3b8f37e0baf4f6d686ea2ef74 tfjs-custom-module is a typosquat of the tensorflow/tfjs package. Its package.json declares a postinstall lifecycle script that runs automatically on npm install. The script collects installer host identifie...

Malicious code in ssb-test-package (npm)

Source: amazon-inspector 086e13ef78d9987210a95cc9e70359d982cd9dbffa59d674d6f5ed3cb8f8a725 [email protected] is a dependency-confusion proof-of-concept. package.json declares preinstall: node poc.js, and poc.js runs unconditionally on npm install, collecting host reconnaissance OS user,...

Malicious code in setup-codex (npm)

Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination at hooks.zapier.com see line 12. The report body includes...

Malicious code in setup-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination...

MAL-2026-14219 Malicious code in setup-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination...

MAL-2026-14221 Malicious code in ssb-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 086e13ef78d9987210a95cc9e70359d982cd9dbffa59d674d6f5ed3cb8f8a725 [email protected] is a dependency-confusion proof-of-concept. package.json declares preinstall: node poc.js, and poc.js runs unconditionally on...

MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

Malicious code in tfjs-custom-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c50d87a4593cb5a0444f2333f368180b64dfb5d3b8f37e0baf4f6d686ea2ef74 tfjs-custom-module is a typosquat of the tensorflow/tfjs package. Its package.json declares a postinstall lifecycle script that runs automatically on...

Malicious code in mutex-thread (npm)

Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes callback.meta.jobId === 'cross-chain-transfer', spawns lib/withLoad.min....

Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159 The package's package.json declares a preinstall script that runs index.js automatically on npm install. index.js shells out via childprocess.exec to...

PT-2026-78817

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description An unauthenticated user can access the add-on OpenAPI specification via Splunk Web static file paths. This exposure occurs because the generated OpenAPI...

PT-2026-77237

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The checkArticleUrl function in defaultmodules/newsfeed/node helper.js accepts the CHECK ARTICLE URL notification via the unauthenticated Socket.IO namespace /newsfeed. The system performs a...

CVE-2026-75104

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...