CVE-2026-18678

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

Malicious code in passkeys-react (npm)

Source: amazon-inspector cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, current working directory, and the contents of /etc/passwd and...

Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd, locates n8n installation directories, enumerates running n8n...

Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

Source: amazon-inspector 4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571 package.json postinstall runs callback.js, and index.js declared main is byte-identical, so both npm install and any require of the package trigger the same payload. The code fetches multiple tarballs mhddos...

Malicious code in @years19/n8n-nodes-utils-helper-s (npm)

Source: amazon-inspector 2955ed4843fe66495bbe53420b28e91530f48facae3aea0a9c3719676c30c0a5 The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600 seconds — and launches it in the background via nohup...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

Malicious code in chapters-core (npm)

Source: amazon-inspector e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992 The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname, os.userInfo.username, process.cwd, and CI/CD attribution environment variables...

Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)

Source: amazon-inspector 5b21f700cd5e3a5eb33a34fa9e3a9754e73e5794ee1cc57ada01344004a8c921 index.js unconditionally loads runtime.js on require. runtime.js detects the host OS and architecture, then downloads an opaque platform-matched binary over HTTPS from hardcoded Cloudflare workers.dev...

CVE-2026-47363

creationtimestamp| type| source ---|---|--- 2026-08-07 18:50:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dhdonwauwwnmr...

Malicious code in ts-utility-plus (npm)

Source: amazon-inspector 75e338acac1218e74bb44a4141ac9eb195da36f48eef6f4b1d11c84fe92a96ef The package's default export getPlugin performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and passes the response field data.credits into new...

Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm)

Source: amazon-inspector 1a9ed4acf296e53ad5955f759a0f0692d641781b1bd4e67ada1c116216f96fc3 The package's postinstall lifecycle script issues an HTTPS request from the installer's machine to a Cloudflare tunnel at wiki-shared-carlos-exempt.trycloudflare.com on path /token-capture. The request is se...

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...

GHSA-7WMF-PW8J-MC78 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...

Malicious code in dolyame-ui-postcsscustomproperties (npm)

Source: amazon-inspector a8be08d3eb5601ca7f7b5f74c34e3fd0ebba91f0b72dea8ab4b0642bb9695c0c On require of the package, shim.js and lib/telemetry.js reached via the main entry select a platform-specific payload, download a binary over HTTPS from string-split Cloudflare Workers hosts...

Malicious code in dolyame-ui-inputsearchtagged (npm)

Source: amazon-inspector 9880fbbce0555f24a1b8910b6271c9b74bd210c1e2aad74bee6ef21338c2eff3 On require of the package, init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-inputdate (npm)

Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-carouselline (npm)

Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g. oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-buttonstore (npm)

Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches opaque bytes over HTTPS from hosts whose names are assembled ...

Malicious code in dolyame-ui-inputfio (npm)

Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in delivery-ci-documentation (npm)

Source: amazon-inspector af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203 On require'delivery-ci-documentation', index.js loads init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames at runtime by joining split string arrays, and downloads a...