Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

MAL-2026-14422 Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

MAL-2026-14428 Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

Malicious code in auth-otp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...

Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

MAL-2026-14438 Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

Malicious code in paypal-business-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent...

Malicious code in manticore-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184c02a26613b94b15f0abe1ed108c7a2a7a061f795213dba4772876e6e0a015 The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hostname, current working...

Malicious code in ppb-manticore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...

Malicious code in web-advertising (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

EUVD-2026-64899

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-39915

TIM Flow before 26.0.6 is affected by a CRLF injection vulnerability in the rt URL parameter (and access token cookie), where unsanitized carriage return and line feed sequences are reflected into Set-Cookie response headers. Remote attackers can inject arbitrary HTTP headers and response body co...

MAL-2026-14424 Malicious code in @medisend/webview-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameter...

Malicious code in @medisend/webview-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameter...

CVE-2026-28166

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-66599

CVE-2026-66599 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete , affecting versions 2.9.5.6 and earlier . The vulnerability was discovered by Asim Alshaya and carries a CVSS v3.1 score of 7.1 (HIGH) with a scope change (CHANGED), reflecting the ab...