PT-2026-120718

Name of the Vulnerable Software and Affected Versions Storybook versions 8.0.0 through 8.6.18 Storybook versions 9.0.0 through 9.1.20 Storybook versions 10.0.0 through 10.6.1 Storybook versions 11.0.0-alpha.0 through 11.0.0-alpha.5 Description Insufficient iframe embedding and message-origin...

skillscript v0.40.1

Safe, reusable automation authored by agents. skillscript.ai • docs TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. See Quickstart. What is Skillscript? Skillscript came from asking: what would a Makefile look like if it built skills instead of binaries? The...

Malicious code in modsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...

MAL-2026-13910 Malicious code in @years20/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60 On npm install postinstall and on require/import of the package's main entry, callback.js and index.js execute id, hostname, and WSL detection, read...

MAL-2026-13223 Malicious code in bigops-logs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a922558781f9614bc47976e2e695cc8a5996ef51865fb5b37928f842718b5d On require of bigops-logs-player, index.js loads polyfill.js, which reconstructs a list of Cloudflare Workers hostnames...

MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

MAL-2026-13152 Malicious code in dolyame-ui-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e2cf3af799e05f20494aba04b5d85aa1335bce541af4cb13aa715a2cda6ea5 On require'dolyame-ui-dropdown', index.js loads helpers.js which selects a platform-specific endpoint from an obfuscated split-literal host list...

MAL-2026-12852 Malicious code in bigops-umf-statist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7 On require'bigops-umf-statist', index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from...

MAL-2026-12968 Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

MAL-2026-12306 Malicious code in twork-products-taiga2-products-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0870bb9f10cb88f264e25b839c6001a3b2c7d77777115871ba0e3c6f61ddb84b On require of this package, index.js loads init.js which selects a platform-specific endpoint, reconstructs destination hostnames at runtime from...

MAL-2026-12218 Malicious code in tailwind-animation-founder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21 The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream...

Malicious code in tailwind-animation-founder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21 The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream...

MAL-2026-12214 Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...

Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair

Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general b...

CVE-2026-46621 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the...

CVE-2026-61643

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow...

MAL-2026-6578 Malicious code in layerd-unit-codec-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca65bb450fc2f4d4596fbcc2ddd81af358c2d02f94d965b18e532d8afa62ef5f The package presents itself as a CSS selector parser src/selector-parser.js re-exports postcss-selector-parser; keywords postcss/selector/parser/css,...