Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

MAL-2026-12920 Malicious code in bnpl-blocks-desktop-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0028d1bea265a3e3fdcbbe1d43188f3aef4b4c332a995352c19ac5a090c42ac On require of the package, index.js loads support.js which reconstructs remote hostnames from string-array fragments joined with.join'' to defeat...

MAL-2026-12922 Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917 On require of the package, index.js loads helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings ar...

MAL-2026-12992 Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370 On require of the package's main entry, shim.js constructs Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf,...

MAL-2026-13100 Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

CVE-2026-41447

FirmaCheck for Windows

MAL-2026-11140 Malicious code in korvica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...

CVE-2026-57860

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

CVE-2026-57860

Technical details about CVE-2026-57860 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-63093 Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves a...

EUVD-2026-45178

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves a...

PT-2026-60775

Name of the Vulnerable Software and Affected Versions Cursor for Windows version 3.2.16 Description A binary planting issue allows remote attackers to achieve arbitrary code execution. This occurs when a developer clones and opens a crafted repository containing a malicious git.exe file in the ro...

Malicious code in data-proxy-for-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cb07f37b05b892d9785cc03fba0754ea4af3a50fab0ca6bb345ecac52b939a2 Package distributes as data-proxy-for-test while copying the identity author Sergey Parfenyuk, homepage/source pointing at...

PT-2026-59532

PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec from file location and immediately executes module-level code via spec.loader.exec module without explicit user consent...

CVE-2016-20092

NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2ServiceNetdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or...

CVE-2016-20089

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, attackers can place malicious executables in the path to be...

CVE-2016-20087

Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the system root path that execute with SYSTEM privileges during...

CVE-2020-37252

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with...