MAL-2026-12206 Malicious code in simple-date-formatter-util-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c package.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the...

Malicious code in simple-date-formatter-util-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c package.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the...

MAL-2026-12205 Malicious code in simple-date-formatter-util-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ec6c790f702e0bb6617bb6bf16ad8b3a154bc7d539938535cde7a2cf205f17 The package's npm postinstall script curls cloud instance-metadata endpoints AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent...

MAL-2026-12200 Malicious code in simple-date-formatter-util-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f8a19e2cff3bcaf070316f16650d8c1af6714f4c44db56971299ef01c16a25 Package advertises itself as a trivial date-formatting utility index.js exports a one-line formatDate wrapper but ships a package.json postinstall ho...

Malicious code in simple-date-formatter-util-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe9863d2e47d22ca16f42efd68d0c79e0b2730b48984bf68b040f6f920fb70ec Package presents itself as a date-formatting utility index.js is a four-line toLocaleDateString wrapper but its package.json postinstall hook runs an...

Malicious code in bigops-data-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0 On require of bigops-data-storage, index.js loads compat.js which unconditionally runs a top-level routine that downloads a native executable from...

Malicious code in bigops-frontend-bigops-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb3c97636fded3935088ac125f923882844470f5638c45176b4254d4dbad714 On require of the package, vendor.js downloads a platform-selected native binary from hardcoded Cloudflare Workers hosts...

CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-71207

The Stock-Inventory-Management-System is affected in login.php, where raw $_POST values are assigned to $_SESSION and concatenated into a SQL query without parameterization, enabling unauthenticated SQL injection. An attacker could bypass authentication by submitting payloads like ' OR '1'='1, le...

CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...

CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

EUVD-2026-53204

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...

Malicious code in @wethenorth12/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d27d76902370899c3362602581cdec59396e1ece2bd87976f1798083957f89 On require of the package's main entry index.js, the code collects process.env, hostname, username, homedir, platform, cwd and a timestamp,...

MAL-2026-12089 Malicious code in @wethenorth12/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56f2c55cacbd8d06b8d3b0f20b808262c42cd002441399d8e39a2f03c600f3c On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and POSTs it to...

Malicious code in @wethenorth12/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56f2c55cacbd8d06b8d3b0f20b808262c42cd002441399d8e39a2f03c600f3c On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and POSTs it to...

Malicious code in @wethenorth12/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...

Malicious code in @wethenorth12/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386 On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and the entire process.env,...

MAL-2026-12107 Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

Malicious code in @wethenorth12/env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de45cab34c84d02c802689caf5a6683df75d402bb17239fea95b395860942ac9 On require, index.js reads the full process.env map along with hostname, username, homedir, platform, and cwd, JSON-stringifies and base64-encodes th...