Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

MAL-2026-12668 Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

MAL-2026-12510 Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

@ccfly/setup (0.1.13) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.13)

@ccfly/setup-darwin-x64 NPM version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.13 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

MAL-2026-12313 Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

@ccfly/setup (0.1.1) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.1)

@ccfly/setup-darwin-x64 NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.6) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.6)

@ccfly/setup-darwin-x64 NPM version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.7) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.7)

@ccfly/setup-darwin-x64 NPM version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.7 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.8) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.8)

@ccfly/setup-darwin-x64 NPM version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.3) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.3)

@ccfly/setup-darwin-x64 NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.9)

@ccfly/setup-darwin-x64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.14) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.14)

@ccfly/setup-darwin-x64 NPM version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.14 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.15) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.15)

@ccfly/setup-darwin-x64 NPM version 0.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.15 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.16) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.16)

@ccfly/setup-darwin-x64 NPM version 0.1.16 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.16 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

EUVD-2026-53349

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

@ccfly/setup (0.1.20) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.20)

@ccfly/setup-darwin-arm64 NPM version 0.1.20 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.20 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12084...

@ccfly/setup (0.1.7) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.7)

@ccfly/setup-darwin-arm64 NPM version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.7 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12084...