Malicious code in ded-pwa-c-mapping (npm)

Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS from string-concatenated .workers.dev hosts...

Malicious code in devplatform-eslint-config (npm)

Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on import selects a payload path based on OS/architecture linuxx6...

Malicious code in devplatform-stylelint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from...

Malicious code in ded-pwa-c-mapping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS...

Malicious code in ded-pwa-ded-pwa-core (npm)

Source: amazon-inspector 97666216930384a372fdf45c3c6a5d744e61de4b8e5c01f82a6ffe5688b168e7 On require'ded-pwa-ded-pwa-core', index.js unconditionally loads adapter.js, which selects a platform-specific target path %TEMP%/dotnetdiag.exe on Windows, /tmp/.cache on POSIX, fetches an opaque binary ove...

Malicious code in ded-pwa-c-cms (npm)

Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from obfuscated author-controlled hosts Cloudflare Workers subdomain...

Malicious code in dolyame-ui-inputcolor (npm)

Source: amazon-inspector abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238 index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners e.g.,...

MAL-2026-13592 Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...

MAL-2026-13554 Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...

Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

Malicious code in @wbnr/frontend-shared (npm)

Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username from process.env USER/USERNAME and hostname os.hostname,...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

CVE-2026-58158

creationtimestamp| type| source ---|---|--- 2026-08-06 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgjpi53yw2r...

Malicious code in golaaa (npm)

Source: amazon-inspector 01b6c227c2b9147d78df3a778d5de60d58b9cb115c6e7a7ce811143e05413ceb The package launches a local browser with remote debugging on port 9222, attaches over the Chrome DevTools Protocol, disables Content Security Policy, and installs a persistent script...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of three string-obfuscated .workers.dev hosts...

GHSA-GX4C-2HQX-CW2R rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

Vulnerability Details File: backend/s3/s3.go Lines: 1359-1380 functions s3CheckRedirect / s3RedirectCrossesHost Root Cause Commit e7b1eb774 released in v1.74.3 added a CheckRedirect policy for the S3 HTTP client whose purpose is to strip the X-Amz-Security-Token header the AWS STS session token...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect handling process. An attacker can intercept sensitive credentials by observing network traffic during a same-host HTTPS-to-HTTP redirect. Remediation Upgrade...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect handling process. An attacker can intercept sensitive credentials by observing network traffic during a same-host HTTPS-to-HTTP redirect. Remediation Upgrade...