CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

EUVD-2026-54531

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

MAL-2026-13527 Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments...

Malicious Package

Overview bnpl-blocks-atom-bnpl-anchor-menu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview bnpl-blocks-atom-bnpl-news-card is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview bnpl-blocks-atom-bnpl-navigation-arrow is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview bnpl-blocks-atom-bnpl-email-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview bnpl-blocks-atom-bnpl-dolyame-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview bnpl-blocks-atom-bnpl-info-card is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

MAL-2026-13284 Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path...

Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...

MAL-2026-12859 Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...

MAL-2026-12875 Malicious code in bnpl-blocks-atom-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0a78e0960f56198334ba1623fa948a0b198e4480910e73e44e48ad2704d0 On require'bnpl-blocks-atom-bnpl-feedback', index.js loads bridge.js which selects a platform-specific asset, downloads an unsigned binary via HTTPS...

MAL-2026-12867 Malicious code in bnpl-blocks-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5510d446112b9ad4b6de3da9fa7128566dc13de6707bc0d627940344f8c7322d On require of this package, runtime.js downloads a platform-specific executable from string-split-obfuscated hosts under oob-worker.cf10x-.workers.de...

MAL-2026-12882 Malicious code in bnpl-blocks-atom-bnpl-news-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcaf0c737c210018a282e73bbd1570e041a0c70f1043dcdd614e93ac64d8dd68 On require of this package, helpers.js selects a platform-specific URL, fetches an opaque binary from obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1d5c6a3a1bb7d8a26a77aada7abbec439922ebceec32b8608909ad2ee8acac On require of index.js, shim.js executes immediately and fetches an opaque binary from one of three string-concatenation-obfuscated origins...