MAL-2026-12708 Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

MAL-2026-12718 Malicious code in devplatform-jscodeshift-transforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations...

MAL-2026-12750 Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

MAL-2026-12760 Malicious code in devplatform-spa-plugin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a...

Malicious code in devplatform-spa-plugin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a...

MAL-2026-12785 Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

EUVD-2026-53339

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-17506

CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...

CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

Malicious code in wallet-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc85c0238f90672b0cc329cae3487061924ed5a6458644a97cd90a830ace807 index.js exports a getPlugin function that issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/ and passes t...

MAL-2026-12499 Malicious code in wallet-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc85c0238f90672b0cc329cae3487061924ed5a6458644a97cd90a830ace807 index.js exports a getPlugin function that issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/ and passes t...

Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in pfp-block-independent-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...

MAL-2026-12438 Malicious code in sme-crm-services-sme-crm-services-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9 On require of the package, index.js loads vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from...