Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...

Malicious code in csv-parser-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca The package is advertised as a CSV parser but ships a postinstall.js that runs on npm install and performs installer-side reconnaissance and...

MAL-2026-12393 Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...

Malicious code in chart-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9 [email protected] advertises itself as a chart data/color helper library index.js contains only trivial color utilities, but ships a...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

MAL-2026-12445 Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

EUVD-2026-53374

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. "$IONMGRPORT:-8089:8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the C...

CVE-2026-71289

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

CVE-2026-71280 go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71275

OpenBK7231T vulnerability CVE-2026-71275: The function http_fn_ota_exec() in src/httpserver/http_fns.c reflects the host query parameter directly into an HTML response via hprintf255, without HTML encoding. A crafted URL like /ota_exec?host= can lead to JavaScript execution in an authenticated ad...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

EUVD-2026-53360

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71272

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71272 Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

MAL-2026-12422 Malicious code in quorvex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...

Malicious code in aegis-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66d1f02c3c943836d41a7ec92c150c5529880890a4cc502115412dddb0c519c The package's declared postinstall hook runs node src/test.js, which issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate...

Malicious code in ccxt-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...

Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...