3262 matches found
MAL-2026-12248 Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...
Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...
MAL-2026-12170 Malicious code in bigops-info-notices (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...
Malicious code in bcore-bravo-eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe55f411284226c68e60cbcae266a390a3ba0ef089a2a709363df3188130f605 The package presents itself as an ESLint config / 'environment config reader' but on require executes an import-time dropper. index.js ends with try...
Malicious code in sotqa-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...
CVE-2026-69264
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CLSA-2026-1782435540 TuxCare security update for bootstrap (1 CVE)
TuxCare rebuilt bootstrap to address 1 CVE. Fixed in 4.1.3-tuxcare.1...
CLSA-2026-1782349132 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.7-tuxcare.1...
CLSA-2026-1781484838 TuxCare security update for bootstrap (4 CVEs)
TuxCare rebuilt bootstrap to address 4 CVEs. Fixed in 4.1.1-tuxcare.1...
CLSA-2026-1780447821 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.6-tuxcare.1...
CLSA-2026-1774743842 TuxCare security update for bootstrap-sass (1 CVE)
TuxCare rebuilt bootstrap-sass to address 1 CVE. Fixed in 3.4.0-tuxcare.1...
CLSA-2026-1774743845 TuxCare security update for bootstrap-vue (1 CVE)
TuxCare rebuilt bootstrap-vue to address 1 CVE. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1774138770 TuxCare security update for bootstrap (1 CVE)
TuxCare rebuilt bootstrap to address 1 CVE. Fixed in 4.6.2-tuxcare.1...
CLSA-2026-1773360979 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.2.0-tuxcare.1...
CLSA-2026-1773360977 TuxCare security update for bootstrap (2 CVEs)
TuxCare rebuilt bootstrap to address 2 CVEs. Fixed in 3.4.1-tuxcare.1...
PT-2026-74055
TuxCare rebuilt bootstrap to address 1 CVE. Fixed in 4.6.2-tuxcare.1...
PT-2026-73965
TuxCare rebuilt bootstrap to address 3 CVEs. Fixed in 3.4.1-tuxcare.1...
PT-2026-73966
TuxCare rebuilt bootstrap to address 8 CVEs. Fixed in 3.2.0-tuxcare.1...