MAL-2026-12324 Malicious code in @nasdtickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d260e32207d8cb161b0a72f1337a42c9755b9550a8eda1e70f0b4182273d476b build/index.js the package main appends a hidden evalatob'...' block after the legitimate exportStar boilerplate, separated by a long run of tab...

Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

MAL-2026-12421 Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

CVE-2026-71280 go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...

CVE-2026-71280

go-shiori's DownloadBookmark() (internal/core/download.go) uses a plain http.Client with no DialContext or destination-IP validation, enabling an authenticated user to supply a bookmark URL of 127.0.0.1 or 0.0.0.0 via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext. Th...

EUVD-2026-53365

go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks. An authenticated user creating or updating a...

CVE-2026-71280 go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...

Malicious code in hubert-verify-primary-email-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...

EUVD-2026-53355

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf. The endpoint validates only that the initial...

MAL-2026-12493 Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

Malicious code in william-data-formatter-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df0b15d8ca8cdfac8baf861a2db501b3b52eb0e41fd44a6690c351bda8c90835 The package declares a preinstall script node index.js that, on Windows, spawns a hidden PowerShell window -WindowStyle Hidden to fetch...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

CVE-2026-71246

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

EUVD-2026-53320

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...