MAL-2026-13788 Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

MAL-2026-13778 Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

MAL-2026-13787 Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

EUVD-2026-57087

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...

MAL-2026-13769 Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

Malicious code in sui-gql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 763079354e471aa241953530a79a946e060402895da52ca47628f1817c452d7e Analysis of the package did not surface install-time lifecycle scripts, credential access, network exfiltration, dropper behavior, silent-relay, or...

MAL-2026-13768 Malicious code in sui-gql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 763079354e471aa241953530a79a946e060402895da52ca47628f1817c452d7e Analysis of the package did not surface install-time lifecycle scripts, credential access, network exfiltration, dropper behavior, silent-relay, or...

Malicious code in sui-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a215fced265f75473130d499c7d6ea6097f63aa19c595fc5445a56633b1c6e On require'sui-bcs-codec', a hidden IIFE labeled 'compat-probe' in index.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, and.env files under cwd...

Malicious code in bs58-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981f5e55b471c2c102357ab650c3fdb6b27d4ab30001be83c532c819c1be350f Package name, README, and keywords mirror the popular base58 encoding library bs58, but the main module contains only require"base65-13x" and...

Malicious code in bs58-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af29bcf6fea2d386f8beb757fa38bac5f1cc6dbae984795f5fd1f4356afd83f7 Package bs58-11 is published under a name that resembles the popular bs58 module. Its README self-identifies as bs58 and instructs npm i --save bs58,...

Malicious code in dakumangalsingh_virus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c32842af81f239247b0cb4980f29b20051e92fed5751d4c297ede4f5a9116d The tarball contains a 455 KB Windows PE64 executable named DakuMangalSingh.exe sha256 368320791e5c022ffabedb44eae6ca902fe3f524754a085b726617c2006dc7...

MAL-2026-13766 Malicious code in node-internal-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea179fb3670844db867458418a68b3eb69dfd983ebe1fe96b2a4b41601266fc4 Package advertises itself as an SVG loader using well-known CDN providers, but exported functions getPlugin, setPlugin, and getPluginExten build a...

Malicious code in developer-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde7491a839ea8dc199215ce4c506b89ec0d9a9b1cded593b063a5b9b7015509 The package presents itself as a 'developer dashboard' but ships a heavily obfuscated single-file payload obfuscator.io-style 0xXXXX identifiers with...

EUVD-2025-210677

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...

PT-2026-70691

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is no...

PT-2026-70427

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70434

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70498

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description An untrusted pointer dereference in the Windows Kernel allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the...

PT-2026-70195

A vulnerability has been identified in Siemens License Server SLS All versions V5.1. The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to...