Malicious code in ai-node-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae845382ff29756db63bf611b9b6bdbd49c44be3bcc8b283512e6590182ac48b ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator string-array rotation, 0x-prefixed identifiers, base64...

MAL-2026-6508 Malicious code in tw-style-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc430da42cdbbb83b681be645a2bbc3f3f2a48e0e19d9d3624b4b3e6f9aa7e92 [email protected] was scanned and produced no findings indicative of supply-chain attack behavior. No install-time lifecycle scripts performing...

MAL-2026-6507 Malicious code in pump-stream-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b661475c354a21044517667315f026469d531e459803f8d4d9586e5cb67f74 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in pino-zod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92ceffaf94fc190f70c18587857f2f0a674a9699512eec79f5cf738eefaa54ca Package advertises itself as a pino+zod logging helper but ships content that does not match that purpose: a dist/discordRelayUpload.js module...

MAL-2026-6506 Malicious code in pump-laserstream-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92a36ce6afdf46f9c63d665ee85ca989b2678feb83e79ff3969c2fb5d1328475 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in wellnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cce5614817c010bad6d6bd86146713b627ad235b87d9ccd341bd3d996a80119 [email protected] ships a 24MB ELF binary named launch which is the XMRig Monero miner RandomX, cn/upx2, ghostrider algorithm strings, libuv/OpenSSL...

EUVD-2026-39583

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

GO-2026-5553 Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry

Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry...

GO-2026-5451 Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju

Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju...

CVE-2026-13281

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

CVE-2026-13281

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

CVE-2026-13281

CVE-2026-13281 involves an integer overflow in Mojo, the Chromium IPC framework used by Google Chrome. A remote attacker who has already compromised the renderer process could potentially achieve a sandbox escape via a malicious file. Affected software: Google Chrome prior to 149.0.7827.201. Root...

Malicious code in easy-time-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b7b165f80957e2b2c8484fe6a51c4c4354727dadd36a51c39265f58e916935 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in block-slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9443517fbcf695478ab489e9a375823ed1a0030cf6a3a4f6262effca4c5406b Pattern matches fired on index.js for the co-occurrence of childprocess require, HTTP GET calls, and env-related keywords within a single file. No...

MAL-2026-6416 Malicious code in block-slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9443517fbcf695478ab489e9a375823ed1a0030cf6a3a4f6262effca4c5406b Pattern matches fired on index.js for the co-occurrence of childprocess require, HTTP GET calls, and env-related keywords within a single file. No...

Malicious code in nabisco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d0ed482ca35ed621384d6d91c398fe605352571a710d8f4222af056cedf48bb Package self-describes as a security PoC for dependency confusion targeting an internal HubSpot module name. On install, postinstall.js prints a...

MAL-2026-6411 Malicious code in data-fetching-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913d882d66d587abb1d6fe92b8b6d7353c1b4ae79fb175cc3f10b606dd5f8457 Package self-identifies in its package.json description as a bug-bounty dependency-confusion proof-of-concept against an internal package name of the...

MAL-2026-6414 Malicious code in two-factor-prompt-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95ebb96758f051c0a5a1c8fe97fb05c898f2489f4567fb64fbd271eb103dcadc Package self-identifies as a dependency-confusion proof-of-concept aimed at an internal/private package name. The postinstall script postinstall.js...

Malicious code in @su-doughnym/hubspot-loginui-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72fa1e159f93bb8a1336dc48fe329f3a7801ebf56a49620ce67fd013ea8995ae Package is openly labeled a dependency-confusion proof-of-concept and uses a high version number 99.99.99 consistent with that intent. The preinstall...

Malicious code in data-fetching-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913d882d66d587abb1d6fe92b8b6d7353c1b4ae79fb175cc3f10b606dd5f8457 Package self-identifies in its package.json description as a bug-bounty dependency-confusion proof-of-concept against an internal package name of the...