CVE-2026-66747

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...

CVE-2026-66747

The CVE describes a firmware implant in Zbtlink router firmware (ENDLESSDOORS) embedded as an OpenWrt package (librctl.so) that runs at boot as root under kworker. It does not listen for connections but phones home over cleartext TCP to a hardcoded C2 address on channels 7000/7001, with no authen...

EUVD-2026-53301

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...

MAL-2026-12291 Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

MAL-2026-12182 Malicious code in json-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...

Malicious code in json-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...

Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

MAL-2026-12219 Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

MAL-2026-12242 Malicious code in tinkoff-fb-rf-add-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788686e9aacdc59ec40f42563a7d9ba5020c75d6c724c8bf59623213b51df780 The package's main entry loads bootstrap.js on require, which downloads a platform-specific executable from string-fragment-obfuscated...

Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520 The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On...

CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

EUVD-2025-210616

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12071 Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

MAL-2026-12070 Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...