2941 matches found
MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...
Malicious code in devplatform-spa-plugin-notifier (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers...
Malicious code in devplatform-spa-plugin-query (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 749fb409dca041d1e546949cfb546398db8752d59153c18e675f691231f3f1c0 On require of the package, index.js loads bootstrap.js, which assembles a C2 hostname by string-splitting fragments oob-worker.cf.workers.dev, select...
MAL-2026-12136 Malicious code in accounts-stores (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d The package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a...
MAL-2026-12242 Malicious code in tinkoff-fb-rf-add-application (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788686e9aacdc59ec40f42563a7d9ba5020c75d6c724c8bf59623213b51df780 The package's main entry loads bootstrap.js on require, which downloads a platform-specific executable from string-fragment-obfuscated...
MAL-2026-12248 Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...
Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...
MAL-2026-12170 Malicious code in bigops-info-notices (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...
Malicious code in bcore-bravo-eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe55f411284226c68e60cbcae266a390a3ba0ef089a2a709363df3188130f605 The package presents itself as an ESLint config / 'environment config reader' but on require executes an import-time dropper. index.js ends with try...
Malicious code in sotqa-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...
CVE-2026-69264
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CLSA-2026-1782435540 TuxCare security update for bootstrap (1 CVE)
TuxCare rebuilt bootstrap to address 1 CVE. Fixed in 4.1.3-tuxcare.1...
CLSA-2026-1782349132 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.7-tuxcare.1...
CLSA-2026-1781484838 TuxCare security update for bootstrap (4 CVEs)
TuxCare rebuilt bootstrap to address 4 CVEs. Fixed in 4.1.1-tuxcare.1...
CLSA-2026-1780447821 TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.6-tuxcare.1...
CLSA-2026-1774743845 TuxCare security update for bootstrap-vue (1 CVE)
TuxCare rebuilt bootstrap-vue to address 1 CVE. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1774743842 TuxCare security update for bootstrap-sass (1 CVE)
TuxCare rebuilt bootstrap-sass to address 1 CVE. Fixed in 3.4.0-tuxcare.1...
CLSA-2026-1774138770 TuxCare security update for bootstrap (1 CVE)
TuxCare rebuilt bootstrap to address 1 CVE. Fixed in 4.6.2-tuxcare.1...