Malicious code in devplatform-s3-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618b016d2ee8f333f47ee78c4ffe29b703a08ab7fca524ee072944394fb1301c On require of the package's main entry, bridge.js assembles Cloudflare Workers hostnames from string fragments via Array.join e.g...

MAL-2026-12747 Malicious code in devplatform-s3-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618b016d2ee8f333f47ee78c4ffe29b703a08ab7fca524ee072944394fb1301c On require of the package's main entry, bridge.js assembles Cloudflare Workers hostnames from string fragments via Array.join e.g...

MAL-2026-12768 Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

MAL-2026-12764 Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

MAL-2026-12776 Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-71260

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

Malicious code in prokit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92 On require of the package, index.js unconditionally loads helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS...

MAL-2026-12409 Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12380 Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...

Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

MAL-2026-12346 Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

MAL-2026-12408 Malicious code in pfp-block-independent-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...

Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...

Malicious code in saas-f-lego-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...