MAL-2026-13336 Malicious code in dolyame-boxy-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6 On require of dolyame-boxy-markdown, index.js loads ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Worker...

Malicious code in bigops-timeline-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a6a5b474ef344ddb8aa478f73099e3644817aa8a87199eaa3c46f03d27baa13 On require of bigops-timeline-ui, index.js loads./adapter.js which fetches a platform-specific binary from Cloudflare Workers hosts whose names are...

Malicious code in boxy-mm-server-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c25489d15bfaaf8e337af2f2fa446e86fdc8cc5fae3199be2451bdb35196ef On require'boxy-mm-server-loader', index.js loads polyfill.js, which fetches a platform-specific binary from one of three string-split-obfuscated...

MAL-2026-13095 Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

CVE-2026-18718 Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyz...