MAL-2026-11390 Malicious code in svelte-metric-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76c232192bc12931cca4480eb306026c8ca4776ace0353ddb00fe7b947515b25 No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code, no credential or environmen...

MAL-2026-11400 Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in consumerweb-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa886e4b335d3fc76fa6bc8e50c2e428ac164165830705c0ab2847857c2b3aa7 The package's preinstall lifecycle script runs automatically on npm install. It collects the installer's OS username os.userInfo.username, hostname...

Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...

CVE-2026-7484

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

CVE-2026-7484

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

CVE-2026-7484 Improper Access Control in Abis Technology's AVESİS

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

CVE-2026-7484

CVE-2026-7484 affects AVESİS (ABIS Technology Ltd. Co.). Description: External control of an Assumed-Immutable web parameter vulnerability allowing access to functionality not properly constrained by ACLs. Affected versions: before 202606251646. Impact per provided metrics: CVSS 3.1 base score 5....

EUVD-2026-48569

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

CVE-2026-7484 Improper Access Control in Abis Technology's AVESİS

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

MAL-2026-11039 Malicious code in yuinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f439dbbb74a729ef5c43bdc62f612060dbc9e6a96b825c8305b88dd43b3172 Package [email protected] contains 3 files and produced no a static rule matches and no traced-code findings indicating exfiltration, install-time...

Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in veskr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...

MAL-2026-11016 Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b247c0aaff056911572cd72fb377332194aa11aa4ada038039e3c35a6755e2a The package [email protected] 6 files exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fetching or executing remote...

ROS-20260722-73-0030

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability could allow an attacker to cause service interruptions...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

MAL-2026-10814 Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f08552c1e41d92205380508c0ea3e1b7085f6eba9ed9cadf3ed1610b0957412b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10816 Malicious code in @gocortexio/npmgremlinbox-cpol-1-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2184d51efaa813eba204f724caf876441f354323d358251674a60def88a83e9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10798 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-igo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab67244a2c791ff06e830004b8fccdbc75449d2c0b85b15b9fa2e2fa995f676 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...