CVE-2026-126453

OpenEMR before 8.5.0 contains an inverted comparison in Document::hasexpired that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/id resource can download expired bulk export...

EUVD-2026-124971

OpenEMR before 8.5.0 contains an inverted comparison in Document::hasexpired that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/id resource can download expired bulk export...

CVE-2026-93649: Download of Code Without Integrity Check

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

Vulnerability in Eclipse Adoptium.net software supply chain

There is a security vulnerability in Eclipse Adoptium.net. It stems from improper validation of URL prefixes in the link parameter and inadequate handling of dot normalization. This may allow attackers to bypass checks, redirect users to a repository controlled by them, and download malicious...

Malicious code in chalk-figlet (npm)

Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry that decodes a hex-obfuscated URL...

Malicious code in eacq-api (npm)

Source: amazon-inspector 1f72372a4c98fc1b4f187839fabe1a0bf8f7d98c8250c06baebf129920474332 On require of eacq-api, index.js loads compat.js which reconstructs C2 hostnames from string-split fragments oob-worker.cf100,1,2,3-.workers.dev and a DNS TXT chunked-base64 fallback channel over .dl.wel1.ru...

Malicious code in dp-owners (npm)

Source: amazon-inspector 09f190519e55e1e9899983a76806e839baf855abf0a0120e83bcac5547405c09 On require of dp-owners, init.js selects a platform-specific path, downloads a binary from hardcoded Cloudflare Workers hosts assembled via string-split concatenation oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-ui-types (npm)

Source: amazon-inspector 237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38 On require of the package, helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-utils (npm)

Source: amazon-inspector 899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199 On require of the package, polyfill.js selects a platform-keyed URL, fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-toggle (npm)

Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback via .dl.wel1.ru, writes it to /var/tmp or %TEMP% under...

Malicious code in dolyame-ui-textarea (npm)

Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of .workers.dev endpoints e.g. oob-worker.cf10x-.workers.dev...

Malicious code in dolyame-ui-react-wrapper (npm)

Source: amazon-inspector 67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33 On require, index.js loads helpers.js which runs setup at module load. The setup routine reconstructs mirror hostnames at runtime by joining split string fragments e.g. 'oob-worker.cf101-adf.workers.dev',...

Malicious code in dolyame-ui-table (npm)

Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev and a DNS-TXT...

Malicious code in dolyame-ui-island (npm)

Source: amazon-inspector 4668c9441e4f15054a71b066764259aac91f52c51e48ff2656a63c9a09f96e5d On require of dolyame-ui-island, index.js loads setup.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev...

Malicious code in dolyame-ui-pagination (npm)

Source: amazon-inspector 7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7 On require of the package, index.js loads./polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at runtime via array-join string splitting to evade static...

Malicious code in dolyame-ui-grid (npm)

Source: amazon-inspector f21d1f60c7f97ffdc8e698c9804d9d9116f286be7a026a9c90f6e4a1858dea18 On require'dolyame-ui-grid', index.js loads polyfill.js which selects a platform-specific asset, downloads a binary from one of four hardcoded Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-input (npm)

Source: amazon-inspector a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242 [email protected] is published as a React component library but ships no UI code. On require, index.js loads shim.js, which downloads a platform-specific binary from split-concatenated Cloudflare Worke...

Malicious code in dolyame-ui-chart (npm)

Source: amazon-inspector d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9 On require of the package, index.js loads shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-spa-plugin-i18next-instance (npm)

Source: amazon-inspector 0a8078abf02317c9e0c0255c48434f68798e80d2282d46acb8a8643e0cdb18c8 On require/import, index.js silently loads setup.js inside a try/catch. setup.js downloads a platform-specific binary from one of four hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-spa-plugin-notifier (npm)

Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers subdomains oob-worker.cf101-adf.workers.dev,...