@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70601 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70601 Source advisory: SNYK:JS-ELECTRON-18563206...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70599 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70599 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70599 Source advisory: SNYK:JS-ELECTRON-18563334...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70598 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70598 Source advisory: SNYK:JS-ELECTRON-18563338...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70597 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70597 Source advisory: OSV:GHSA-JM7P-CC5G-QWXX...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70597 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

Malicious code in dolyame-boxy-independent-bnpl-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3490fd11839adb1f5027facaf8046cd19e640fffdbf79d0684c91a565dd8303 On require of the package's main entry, index.js loads adapter.js which performs OS/arch detection and fetches an opaque binary from...

MAL-2026-13335 Malicious code in dolyame-boxy-independent-bnpl-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3490fd11839adb1f5027facaf8046cd19e640fffdbf79d0684c91a565dd8303 On require of the package's main entry, index.js loads adapter.js which performs OS/arch detection and fetches an opaque binary from...

MAL-2026-13147 Malicious code in dolyame-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binar...

Malicious code in dolyame-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binar...

Malicious code in dolyame-ui-confirmation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture,...

MAL-2026-13171 Malicious code in dolyame-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four...

Malicious code in dolyame-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four...

MAL-2026-13191 Malicious code in dolyame-ui-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from...

Malicious code in dolyame-ui-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from...

MAL-2026-13192 Malicious code in dolyame-ui-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d index.js unconditionally requires./platform on module load. platform.js reconstructs attacker-controlled hostnames via string-splitting Array.join to...

Malicious code in bigops-telephony-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98fd12faa59a5e65d0383cfb3be55ccd49beca5c74cb350b62f5717be83bcd65 On require of bigops-telephony-client, index.js loads./runtime.js, which unconditionally downloads a platform-specific binary over HTTPS from...

MAL-2026-12841 Malicious code in bigops-telephony-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98fd12faa59a5e65d0383cfb3be55ccd49beca5c74cb350b62f5717be83bcd65 On require of bigops-telephony-client, index.js loads./runtime.js, which unconditionally downloads a platform-specific binary over HTTPS from...

MAL-2026-12889 Malicious code in bnpl-blocks-atom-bnpl-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1d5c6a3a1bb7d8a26a77aada7abbec439922ebceec32b8608909ad2ee8acac On require of index.js, shim.js executes immediately and fetches an opaque binary from one of three string-concatenation-obfuscated origins...

Malicious code in bnpl-blocks-consts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific...