Malicious code in cardsmobile-command-utils (npm)

Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers subdomains, writes it to a hidden temp path with a decoy na...

Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

CVE-2026-3067

CVE-2026-3067 affects HummerRisk up to version 1.5.0, targeting the Archive Extraction code path in hummer-common-core: CommandUtils.extractTarGZ and extractZip. The issue enables path traversal via manipulation of extracted archives, and is remotely exploitable. Public disclosure of the exploit ...