MAL-2026-13514 Malicious code in eacq-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b500358c69db5b11d186a6656bd7e20b6ae98cf8f8b437af7b320d511f870761 On require of eacq-core, both helpers.js and lib/telemetry.js download a platform-specific binary from Cloudflare Workers hosts assembled at runtime...

CVE-2026-48007: Exposure of Sensitive Information to an Unauthorized Actor

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo,...

WordPress Independent Analytics – WordPress Analytics Plugin plugin <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Independent Analytics - Google Analytics Alternative for WordPress versions = 2.15.0...

Malicious Package

Overview bnpl-blocks-analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13348 Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

Malicious code in bigops-legacy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb10772ad63d0dbea89e74d3ad56deb097746551202cae3fb1a253b42ca11e0 On require'bigops-legacy-utils', index.js loads polyfill.js which selects a platform-specific payload path, downloads opaque binary bytes from...

Malicious code in bigops-product-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 173f02a73c0c5d6ee6ac7bb757fa64aef91178cfb38c4772d30260c9a7ea4bc1 index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined...

Malicious code in bigops-products-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79495f4d434b2f860f25315bc4c035d0db6956c8184ccb9a8068d1f6a4a15673 On require'bigops-products-bnpl', index.js loads runtime.js, which selects a platform-specific endpoint and downloads an opaque binary from one of fo...

Malicious code in bigops-products-accounts-and-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8 On require of this package, index.js loads shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated...

MAL-2026-13262 Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

Malicious code in docflow-cryptopro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b838ab488feb43fe2b50d6cd00579d3c1528877ea84d935ca89d8d863528bd25 On require of the package's main, platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

MAL-2026-13135 Malicious code in dolyame-ui-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e On package load, index.js requires./platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-13133 Malicious code in dolyame-ui-accordion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637 The package is advertised as a React accordion UI component but on require unconditionally loads vendor.js, which downloads a platform-specific binar...