MAL-2026-12680 Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

MAL-2026-12681 Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12373 Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-12375 Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

MAL-2026-12301 Malicious code in twork-data-services-sme-agent-company-relation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967bdfae105295a824e45402395d3b82a515d225081bc94f4d5998b2884df38 index.js unconditionally requires./init on module load. init.js assembles host names at runtime via array join to hide them from static scanners, the...

Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12286 Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in tinkoff-statist-browser-typed-client-sme.users.origination.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bfbb507be06c5d117ac6bfdff47a2441c2198b0d5702e4da97f598bc0d880a3 The package's main entry require's loader.js, which at import time downloads a per-platform binary from string-concatenation-obfuscated Cloudflare...

MAL-2026-12251 Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

CVE-2026-66277

A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by sending an excessive number of transfer frames, leading to uncontrolled resource usage and a potential denial of service DoS. This vulnerability arises because the system does not properly govern the maximum...

CVE-2026-67592

CVE-2026-67592 affects Apache Qpid ProtonJ2 (through 1.1.0). The issue is an inability to govern the maximum number of transfer frames per incoming delivery, allowing an authenticated attacker to cause excessive resource usage and a potential denial of service. The documented remediation is to up...

CVE-2026-67592 Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67592 Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67555

The CVE-2026-67555 entry concerns Apache Qpid Proton-Dotnet up to version 1.0.0, where the maximum number of transfer frames per incoming delivery could not be governed. This could allow an authenticated attacker to cause excessive resource usage and potential denial of service (availability impa...

CVE-2026-68078

The CVE describes a DoS risk in Apache Qpid Broker-J caused by an inability to govern the maximum number of transfer frames per incoming delivery. This weakness allows an authenticated attacker to trigger excessive resource usage, potentially degrading service. Affected versions are up to 10.0.1;...

CVE-2026-68078 Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version...