CVE-2019-25296

The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfbuploadform and lfbremoveFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrar...

Malicious code in bnia-work (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78b12fa102dbd32d8d3a27c016f7b790124a3a73bdf1970768799e120183c30 The package bnia-work was found to contain malicious code. Source: ghsa-malware 2583fa3177342feb8975727c7ad5873d1a1e7bea2ce3ce445343aaa9a0b3459b Any...

Malicious code in svelte-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 822b182580c298051b9c1f8bb1e807bdb6c780fce64845002feebe37eddd0fad The package svelte-monorepo was found to contain malicious code. Source: ghsa-malware 1f5c5e96c4223fbe3046df01f3cda3aa9b821888050b45d82e92688609a7284...

Malicious code in week-4-node-modularization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0183bf3fb4823612b5a0668f2fc3e58fe3de5ee161fa9acd80244e0400dc40b9 The package week-4-node-modularization was found to contain malicious code. Source: ghsa-malware...

Malicious code in hoppscotch-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccc9fa1661ed3de2ac221307d7e5cac1aea785ac1d0e2241ecd0001a05fea796 The package hoppscotch-agent was found to contain malicious code. Source: ghsa-malware 7c2ae92a02c69aaa3b5287d2172d0fbc6f8f1e3ae51c69f76c7a07e4dcc7a1...

MAL-2026-150 Malicious code in hoppscotch-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccc9fa1661ed3de2ac221307d7e5cac1aea785ac1d0e2241ecd0001a05fea796 The package hoppscotch-agent was found to contain malicious code. Source: ghsa-malware 7c2ae92a02c69aaa3b5287d2172d0fbc6f8f1e3ae51c69f76c7a07e4dcc7a1...

PT-2026-1685

Name of the Vulnerable Software and Affected Versions WP Cost Estimation versions up to and including 9.642 Description The WP Cost Estimation plugin for WordPress is affected by a flaw allowing arbitrary file uploads and deletion. This is due to a lack of file type validation in the lfb upload...

Malicious code in spark-ar-core-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1285c72e9b251b778e8914d717f3408a94460a9f9aca70a65945e4c510c5651f The package spark-ar-core-libs was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview spark-ar-jest-mocks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in awsm-acslibs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75908418c77ed1eed9d51f2880e20a9608a49fe6e21582715517f0fa4044d349 The package awsm-acslibs was found to contain malicious code. Source: ghsa-malware 566e39645aaa10c8e2d212725d48fa1023624b811c5d98b6c4cf6354d1beba95 A...

Malicious Package

Overview rt-live-hero is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in rt-global-nav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02bd8de33c5be198041c736003639439fad9b5df269d489cc4ab29b59191cab7 The package rt-global-nav was found to contain malicious code. Source: ghsa-malware e72ac5f9f497c4ba74c3c745f0cbfce94d7acf109ca98ff38f916fd8afa59e0f...

Malicious code in rt-live-hero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b963cc4f9c61717fb440dbd17f3897337fd7aa94a3d077bcd8307c2faf109c57 The package rt-live-hero was found to contain malicious code. Source: ghsa-malware f56b0f0c83fe7af0849099067abaa56333d2eadffeb3f8152244c74b40a706d6 A...

MAL-2026-129 Malicious code in aws-target-mediator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ebc5003f75ac973cedd53d212f4d9b3dc016b36e43b24ca0a10e77e485b9141 The package aws-target-mediator was found to contain malicious code. Source: ghsa-malware...

MAL-2026-133 Malicious code in language-capirca (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd955d0634b6bcda38eae58473a0e1bf135cde9c2036c680ee490ef1c4ba698 The package language-capirca was found to contain malicious code. Source: ghsa-malware 2a357e83ec0c25df41c3b48d19bcd056e7faf888bfc0a5d148ab30ac7f8884...

MAL-2026-130 Malicious code in awsm-acslibs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75908418c77ed1eed9d51f2880e20a9608a49fe6e21582715517f0fa4044d349 The package awsm-acslibs was found to contain malicious code. Source: ghsa-malware 566e39645aaa10c8e2d212725d48fa1023624b811c5d98b6c4cf6354d1beba95 A...

MAL-2026-135 Malicious code in npe-toolkit-faves (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d361a1a46446a6e7317c9f4c3db039746ceea8e599e55c309a86dba366e8ecc6 The package npe-toolkit-faves was found to contain malicious code. Source: ghsa-malware...

MAL-2026-143 Malicious code in rt-text-media-grid-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f688a9034313f7d48c41ada2e48af7bd425c27af69a13fb41f5ba38c5eca66de The package rt-text-media-grid-collection was found to contain malicious code. Source: ghsa-malware...

MAL-2026-141 Malicious code in rt-long-form-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7aafc418ec6a49447f89597e76416b14a45ffa82d65fb393dc3bb91d1fca38ac The package rt-long-form-content was found to contain malicious code. Source: ghsa-malware...

Malicious code in create-react-app-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dce198bea6270ee06edafb853bcde3e517778beca89073512ee6d6cf1da2304 The package create-react-app-lambda was found to contain malicious code. Source: ghsa-malware...