14 matches found
ROOT-APP-GOBINARY-CVE-2026-39883 CVE-2026-39883 in go.opentelemetry.io/otel/sdk - Patched by Root
Root has patched CVE-2026-39883 in the go.opentelemetry.io/otel/sdk package for Root:Go. Multiple fixed versions available...
Malicious code in dolyame-ui-popover (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers...
MAL-2026-13174 Malicious code in dolyame-ui-popover (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers...
Malicious code in bnpl-blocks-desktop-bnpl-header (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935 On require of this package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments e.g...
MAL-2026-13001 Malicious code in bnpl-blocks-mobile-bnpl-picture-gallery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fab6b4486cfd526c741063bd79f43ac71b870f9dc859dd2057c35f1121166443 On require, bootstrap.js selects a platform-specific asset path and downloads a binary from one of several Cloudflare Workers hostnames whose names a...
Malicious code in bpm-foundation-nest-keycloak-connect (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955 On require of the package, index.js loads shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Worker...
MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...
MAL-2026-12653 Malicious code in cobrowsing-decorators (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...
Malicious code in devplatform-jscodeshift-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...
MAL-2026-12743 Malicious code in devplatform-react-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c On require of the package, index.js loads helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting...
Malicious code in pfp-block-independent-iframe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...
CLEANSTART-2026-EM89202 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Multiple security vulnerabilities affect the cass-operator package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-GI57625 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the fluent-operator-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...