MAL-2026-14370 Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

Malicious code in @syncraft-labs/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...

MAL-2026-14368 Malicious code in @syncraft-labs/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...

EUVD-2026-64624

A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /phpaction/printOrder.php. Such manipulation of the argument clientName/clientContact leads to cross site scripting. The attack may be performed from remote. The explo...

CVE-2026-78059 SourceCodester Stock Management System printOrder.php cross site scripting

A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /phpaction/printOrder.php. Such manipulation of the argument clientName/clientContact leads to cross site scripting. The attack may be performed from remote. The explo...

CVE-2026-78059

SourceCodester Stock Management System 1.0 contains a cross-site scripting (XSS) vulnerability in the file /php_action/printOrder.php. The root cause is improper handling of the clientName and clientContact arguments, which can be manipulated to inject malicious scripts. The attack is remote and ...

CVE-2026-78059 SourceCodester Stock Management System printOrder.php cross site scripting

A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /phpaction/printOrder.php. Such manipulation of the argument clientName/clientContact leads to cross site scripting. The attack may be performed from remote. The explo...

MAL-2026-14372 Malicious code in create-coin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380 Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards...

Malicious code in create-coin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380 Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards...

MAL-2026-14369 Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

MAL-2026-14367 Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

MAL-2026-14371 Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

Malicious code in rust-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65 The package impersonates the pino logger in its README, keywords, and API surface. index.js exports middleware that spawns lib/caller.js as a detache...

MAL-2026-14374 Malicious code in rust-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65 The package impersonates the pino logger in its README, keywords, and API surface. index.js exports middleware that spawns lib/caller.js as a detache...

MAL-2026-14375 Malicious code in solidity-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8 Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns...

Malicious code in solidity-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8 Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns...

Malicious code in hatdhat-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83b6e58e31221d5d14386a193ab49381950bb01307ac4fb4d7e5c30d246046d9 Package presents itself as a pino-style logging utility but its middleware entrypoint index.js spawns lib/caller.js as a detached Node process...