Malicious code in bigops-storio-ngrx-component-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e The package name resembles @ngrx/component-store. The main entry index.js requires./helpers, which on module load assembles attacker-controlled...

MAL-2026-12905 Malicious code in bnpl-blocks-atom-image-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629920c8010c4cc8284a3698f4d748214d9ac784f67df8250ace5e656240ecb3 On require of the package, index.js loads setup.js which reconstructs attacker-controlled hostnames from split-string arrays...

Malicious code in bnpl-blocks-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063ad90855d7ee9b794ccc1e32a794000434fb6955e82152a4d4118ff8e3e266 On require of the package, index.js loads bridge.js which reconstructs attacker-controlled hostnames via array.join"" string splits...

MAL-2026-13033 Malicious code in boxy-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0 On require of the package, index.js loads shim.js which reconstructs attacker-controlled hostnames from split-string arrays Cloudflare Workers...

Malicious code in boxy-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecbc929cc9a3cab12301c7879112bd95abb78812a0248415cc4f7c075d3eec1 On require of the package, index.js unconditionally loads compat.js, which reconstructs attacker-controlled hostnames from split string arrays...

Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

Malicious code in candy-candy-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joinin...

Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

MAL-2026-12684 Malicious code in delivery-ci-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...

Malicious code in delivery-ci-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036 On require of the package's main index.js, support.js reconstructs attacker-controlled hostnames from string-split arrays...

MAL-2026-12295 Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036 On require of the package's main index.js, support.js reconstructs attacker-controlled hostnames from string-split arrays...

Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

MAL-2026-12248 Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups fo...

CakePHP Authentication: Open redirect weakness via backslash bypass

Impact The getLoginRedirect method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames. Patches 2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue. Workarounds If you are unable to upgrade, you should consider adding application validation to t...