MAL-2026-12393 Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...

MAL-2026-12443 Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2 On require, index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

Malicious code in dolyame-boxy-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19 On require of the package's main, index.js side-loads runtime.js which selects a per-platform payload path, fetches an opaque binary from string-spli...

EUVD-2026-53359

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71274 OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

CVE-2026-66747

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...

CVE-2026-66747

The CVE describes a firmware implant in Zbtlink router firmware (ENDLESSDOORS) embedded as an OpenWrt package (librctl.so) that runs at boot as root under kworker. It does not listen for connections but phones home over cleartext TCP to a hardcoded C2 address on channels 7000/7001, with no authen...

CVE-2026-17802

A side-channel information leakage flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514512198...

CVE-2026-10090

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

Malicious code in pfp-integration-mobile-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170 On require of the package, bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of...

MAL-2026-12289 Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...

MAL-2026-12212 Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...

MAL-2026-12191 Malicious code in scandoc-scandoc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88040968dbf46cb6d8018a4c21563f6845140435ce3b93e69b0934a81a8a469b On require of the package, index.js loads vendor.js which fetches a platform-specific binary from Cloudflare Workers hostnames reconstructed at runti...

MAL-2026-12178 Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...

MAL-2026-12230 Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...