Malicious code in https-proxy-utils (npm)

--- Credit: OpenSSF source...

Malicious code in https-agen-chii (npm)

--- Credit: OpenSSF source...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-requests (UTSA-2023-002301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002301 advisory. Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint...

Malicious code in fa-mcp-sdk (npm)

Source: amazon-inspector 62142cbcb6da6a6c078dd91a92cc28d8cfa30a9f4fc901ab2cdbc4cfd6540abb The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it imports childprocess, https, fs, and os; reads os.hostname and other system...

CLEANSTART-2026-LE73008 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the prometheus-redis-exporter package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

Malicious code in unifi-credential-server (npm)

Source: amazon-inspector 6c9d5fc3394d6f2565267e1b19573ca0c58dbbe9149f7204ea39ccae5c53645f package.json declares a preinstall hook that runs index.js on npm install. index.js collects hostname, username, working directory, internal IPv4 addresses from os.networkInterfaces, and CI/build environment...

PT-2026-89243

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description Improper certificate validation occurs when the module makes outbound HTTPS requests, allowing an Adversary in the Middle AiTM attack. An attacker capable of...

Malicious code in @umschool/analytics (npm)

Source: amazon-inspector 7ce44bf9d1ffcc0a63fbc4e955c97cbd45f928e90ba052c49d4cce211b7fed96 @umschool/[email protected] ships a postinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo.username, os.platform, process.cwd, and process.version, base64-encodes...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

Malicious code in eacq-payform-core (npm)

Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are reconstructed at...

Malicious code in eacq-acq-menu-core (npm)

Source: amazon-inspector daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc On require, index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays e.g., 'oob-worker.cf.workers.dev' and 'sdk.dl.wel1.ru' and downloads a platform-specific binary via https.get. T...

Malicious code in dolyame-ui-codemods (npm)

Source: amazon-inspector aa4592f76ef0995b4e3c8b0cc15c00862cf594cbaebbfcd2bf25d2640bbf6012 On require'dolyame-ui-codemods', index.js loads polyfill.js, which reconstructs remote hostnames from split string-fragment arrays joined at runtime assembling oob-worker..workers.dev subdomains and...

Malicious code in dolyame-ui-colors (npm)

Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binary dropper. shim.js selects a platform-specific endpoint an...

Malicious code in dolyame-ui-footer (npm)

Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)

Source: amazon-inspector 1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074 On require, index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via string-split concatenation oob-worker.cf1-02-baf.workers.dev...

Malicious code in devplatform-s3-resources (npm)

Source: amazon-inspector 85d9e5338b835856fe3c5e45555c1a6bfbb6b7f412a83bbfaa0841813eeeeeb1 On load, index.js unconditionally requires./compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-spa-plugin-query (npm)

Source: amazon-inspector 749fb409dca041d1e546949cfb546398db8752d59153c18e675f691231f3f1c0 On require of the package, index.js loads bootstrap.js, which assembles a C2 hostname by string-splitting fragments oob-worker.cf.workers.dev, selects a platform-specific payload path /pkg/package,...

Malicious code in devplatform-spa-plugin-s3-feature-toggle (npm)

Source: amazon-inspector 7574ec8653333519f651022c1d008eca37f884dc753ad8825cda3facdcd9aa61 On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from obfuscated Cloudflare Workers subdomains oob-worker.cf103-070.workers.dev,...

MOVEit Transfer - Remote Code Execution

In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...