Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-12373 Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

Malicious code in async-mutex-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133 Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its...

MAL-2026-12375 Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

MAL-2026-12447 Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

Malicious code in gekko-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child...

Malicious code in fry-page-maker-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa133d7d2ce61c2b2b4d2c48beec5e819a49b52349f7f0b212e446a667457ea7 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload linuxx64, linuxarm64, darwin, win32, downloads it...

MAL-2026-12374 Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

MAL-2026-12446 Malicious code in statist-browser-typed-client-itsa.digitalinterview.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f27a3b0f4b5c8f210576fe33a1251d774926e6c7405591948c5bc3dfa00e7aa On require, index.js loads init.js which selects an OS/arch-specific staging path, downloads a binary payload from hardcoded Cloudflare Workers hosts...

Malicious code in form-bnpl-dolyame-component-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda On require of the package, polyfill.js selects a platform-specific binary and downloads it over HTTPS from Cloudflare Workers subdomains whose...

Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a ci POST parameter obtained via cotimport'ci', 'P', 'TXT' trim-only sanitization is passed to unserializebase64decode$...

Malicious code in streak-math-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...

CVE-2026-71291

Bolt CMS is affected by a server-side template injection: content fields rendered by Twig are not sandboxed. In Field.php, getTwigValue() renders raw values when shouldBeRenderedAsTwig passes checks (field allow_twig flag and a {{, {%, or # regex), using Twig without sandboxing via createTemplate...