NPM: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

NPM: DOMPurify: INPLACE hook removal leaves a detached subtree executable, causing XSS vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.12...

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Summary During INPLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize returns, even though the returned root is clean and the image remains disconnect...

GHSA-55Q2-FJHQ-7XH7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Summary During INPLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize returns, even though the returned root is clean and the image remains disconnect...

MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

MAL-2026-13526 Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

Malicious code in devplatform-stylelint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from...

MAL-2026-13595 Malicious code in dolyame-ui-postcsscustomproperties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8be08d3eb5601ca7f7b5f74c34e3fd0ebba91f0b72dea8ab4b0642bb9695c0c On require of the package, shim.js and lib/telemetry.js reached via the main entry select a platform-specific payload, download a binary over HTTPS...

Malicious code in ded-pwa-c-mapping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS...

MAL-2026-13535 Malicious code in ded-pwa-c-mapping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS...

MAL-2026-13555 Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

Malicious code in platform-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023 On require of platform-ui-colors, both the declared main lib/telemetry.js and helpers.js fetch an opaque binary from author-controlled Cloudflare...

MAL-2026-13570 Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

MAL-2026-13569 Malicious code in dolyame-ui-flatcorners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated...

MAL-2026-13592 Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...

Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments...

MAL-2026-13554 Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

Malicious code in dolyame-ui-memoizeweak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-inputtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5 On require'dolyame-ui-inputtime', index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...