MAL-2026-13530 Malicious code in bnpl-blocks-atom-bnpl-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e219aa368cf93296783647d204c970e9302c41fab778d953471f7ce905f3dfdc On any require/import of this package, index.js loads setup.js, which reassembles four oob-worker.cf.workers.dev hostnames from split string fragment...

Malicious code in ded-pwa-ded-pwa-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97666216930384a372fdf45c3c6a5d744e61de4b8e5c01f82a6ffe5688b168e7 On require'ded-pwa-ded-pwa-core', index.js unconditionally loads adapter.js, which selects a platform-specific target path %TEMP%/dotnetdiag.exe on...

MAL-2026-13512 Malicious code in dolyame-ui-tabsblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g...

Malicious code in delivery-ci-jira-rnd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9178cec9a952384e307589c3d50840761b3c260ced53213ec8a02f85f629bfd9 On require of the package, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary over HTTPS from Cloudflare...

Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

MAL-2026-13496 Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

MAL-2026-13509 Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...

Malicious code in dolyame-ui-stateutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcb488491701865d9106e75e576785ff3b4f1d9687e456eb69f1ff69d8a393f On require/import, index.js loads loader.js which fetches an opaque platform-specific binary from one of three obfuscated Cloudflare Workers endpoint...

MAL-2026-13511 Malicious code in dolyame-ui-stateutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcb488491701865d9106e75e576785ff3b4f1d9687e456eb69f1ff69d8a393f On require/import, index.js loads loader.js which fetches an opaque platform-specific binary from one of three obfuscated Cloudflare Workers endpoint...

MAL-2026-13502 Malicious code in devplatform-react-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Worker...

Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

MAL-2026-13503 Malicious code in distributorblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea The package's main entry index.js re-exports a decoy telemetry module and unconditionally requires setup.js. On require, setup.js selects a...

EUVD-2026-54226

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

tenzir v6.9.0

Data Pipelines for Security Teams Collect, transform, enrich, and route your telemetry—all in one place. What is Tenzir? Tenzir is the data pipeline engine for security teams. If you need to collect, parse, shape, normalize, aggregate, store, query, and route security telemetry data at scale,...

Malicious code in @ks-video/kwai-player-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222 On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname,...

macnoise v0.3.0

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...

Malicious code in bigops-legacy-telephony-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from...

MAL-2026-13221 Malicious code in bigops-legacy-telephony-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from...

MAL-2026-13222 Malicious code in bigops-legacy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb10772ad63d0dbea89e74d3ad56deb097746551202cae3fb1a253b42ca11e0 On require'bigops-legacy-utils', index.js loads polyfill.js which selects a platform-specific payload path, downloads opaque binary bytes from...

Malicious code in bigops-jsonpath-mapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 784552abf30d07bd647e0c3844dc45ea0205cf20c166ca1e38ef924c5fd999b7 On require of bigops-jsonpath-mapper, index.js loads bridge.js which assembles hostnames from string-array joins to hide the destinations...