Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...

MAL-2026-13009 Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in devplatform-spa-plugin-error-boundary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282ec333b26c6283eb35916acab1db10c1362d296d0694b1548882c6e48c06be The package's main index.js unconditionally requires./ext, which runs at load time and fetches a per-platform binary over HTTPS from...

MAL-2026-10423 Malicious code in supertokens-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f7432721b5d9f09bbad0d21c0850ab4284d170fd5d9093721859be5ca9dfb58 The package's main module index.js re-exports supertokens-web-js as a cover and, on require, fetches a binary from...

python-apt Version fetch binary source Data Compromise

The vulnerability of the Version.fetchbinary and Version.fetchsource functions in the python-apt package installation module is related to an error in downloading files from repositories that do not have a signature. Exploiting this vulnerability could allow a remote attacker to compromise data...

python-apt Version fetch binary source Data Compromise

The vulnerability of the Version.fetchbinary and Version.fetchsource functions in the python-apt package installation module is related to the improper verification of the MD5 hash sum only for the uploaded files. Exploiting this vulnerability could allow a remote attacker to compromise data...

DEBIAN-CVE-2019-15796

Python-apt doesn't check if hashes are signed in Version.fetchbinary and Version.fetchsource of apt/package.py or in fetcharchives of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5...