MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11009 Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

Malicious code in gulp-jscrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7353f50ebadb90b9c561e3e70b53c89712bafd182fdc3eb16e536651b972092 gulp-jscrambler is a Gulp plugin wrapping the Jscrambler code-protection API. No install-time lifecycle scripts, credential harvesting, exfiltration...

Malicious code in prettier-plugin-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e4c522699877c1eca1bb9c838a443e3c4bfa21950cf5c5b1d23182ae91a534e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in abuden224 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b6da7762075dee890b0878af8420637eed76f394f658992c5e10454e09e1e2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07035c6d64cbb510ca87260a3a3ca216e2ddfcffcb0ffba6d40ba9f8444c5e0f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33cbeb0130c1ef8842cc7d912f9d12b756efd200949266a3232a83cbfd2cdce4 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in @jplopezy/connectivity-test-do-not-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94a8451d9e6d0f50b066cc79da664b4ec909dc1fb835c39f938b5a58dd9f8ad5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6683 Malicious code in nbmolviz-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a233f99e766d901cd0bc65a98151969dcdbe3657a6d78f7b90ae31b958ed1045 No a static rule matches and no traced behavior of concern were identified in this package version. No evidence of credential access, exfiltration,...

MAL-2026-6659 Malicious code in cdocs-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e752c40246ae31a84c87fdd3bdc7ff7cd8eda3f7cb6765417917859a0edbd49a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-54289

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the MergePodSpec process. An attacker can gain unauthorized access to cluster nodes and potentially take control of the entire cluster by injecting malicious fields into the podSpec configuration...

Malicious code in @cplace-paw-fe/cf-training-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c5db73fe2d964e3a417f9c13904b52af166bffa1edb36401e0dda939c281354 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tiny-naturalsort (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ecbb6057e556f6985eb20768788e9f7dcf6146b3fdbe703653ce0d52c2a4a31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-34126

TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup phase is transmitted in cleartext without encryption. Bluetooth is only used during initialization. An attacker within the Bluetooth rang...

MAL-2026-4846 Malicious code in @service-suppliers/fetch-initial-suppliers-watcher-saga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e38be804fe779ace5ea3a6a56214beebe7ceabaa5f765b46a0f7888ed2da4fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4336 Malicious code in webservices.rest-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9c78a4d0c87def69bbc5337e41a730e7ca6ae898426759915f053dc584581c package.json declares both preinstall and postinstall hooks that execute index.js, which exfiltrates installer data to a base64-encoded Cloudflare...