Malicious code in runtime-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1 The package's postinstall script src/test.js issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled...

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

Malicious code in digital-interview-digital-interview-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67152c58e29424a173ed692a1c5e15d980cc0b54518accf2f9d2811747b9fc3 On require of the package, helpers.js downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are reconstructed at runtime...

Malicious code in time-linters-webapp-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c The package's top-level index.js unconditionally requires./runtime on load. runtime.js assembles a rotating list of Cloudflare Workers hostnames...

MAL-2026-12443 Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2 On require, index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose...

Malicious code in streak-day-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82 index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants process, fetch, childprocess,...

Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12454 Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12413 Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

Malicious code in @copilot-mcp/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c95a10852a2ffe12a9d2b124d014e2092dc2f2d45821ab92feae8cb5308b94ea install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript with 'do shell script' on macO...

MAL-2026-12333 Malicious code in @zahlen/checkout-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097440ff1155e4d840568cf0fc8502c00d43249340f0f301167a859fd34c9fe8 The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation \uXXXX to hide imports of...

Malicious code in streak-daykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...

Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

EUVD-2026-53366

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71279

CVE-2026-71279 : Zigbee2MQTT’s ExternalJSExtension.getFilePath() uses path.join(basePath, name) on a name supplied via MQTT without sanitization. This allows path traversal (e.g., "../../tmp/evil.js") to escape the extensions directory and, after validating the suffix (.js/.mjs/.cjs) and writing ...

Malicious code in hubert-verify-primary-email-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...