Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x67c-8pwr-m8g3. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns...

Malicious code in modern-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5 On server-side require of modern-localization, the package's main entry runs a top-level async IIFE syncLanguageSystem that performs an HTTP GET...

MAL-2026-13650 Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

Malicious code in sme-rko-finance-front-operations-penalty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

MAL-2026-13512 Malicious code in dolyame-ui-tabsblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g...

Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

MAL-2026-13185 Malicious code in dolyame-ui-stepper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3 On require'dolyame-ui-stepper', index.js unconditionally loads shim.js, which assembles hostnames from split string fragments resolving to...

Malicious code in devplatform-vite-plugin-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...

Malicious code in bigops-ui-kit-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1 On require of bigops-ui-kit-styles, index.js loads compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomai...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13039 Malicious code in boxy-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d0a7cd9dacffcb1188a7f6dfdde918d6ef5ba334e773f44330c93f4dd38ddf On require of the package, index.js unconditionally loads runtime.js, which fetches an OS-specific binary from attacker-controlled hosts under...

MAL-2026-13057 Malicious code in boxy-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1164ada14e000c3802b5766cdd31ef169e8f15a6d132cbe52d88b0c593b03c2a On require of the package, bridge.js downloads a platform-specific binary from obfuscated Cloudflare workers.dev hosts...

MAL-2026-13121 Malicious code in bpm-foundation-test-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319 On require of the package, index.js loads bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments...

Malicious code in claims-create-client-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9da539004d6a9ae666f733556ea55cc9ec81bd01efb27810f72f388cedcfc1d1 On require'claims-create-client-validator', index.js loads vendor.js whose top-level bootstrap fetches an OS/arch-specific native binary over HTTPS...

Malicious code in claims-payout-offer-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers...

Malicious code in devplatform-api-v2-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f78874e3ff64b85f64b75f0481a7cadc00f15dea7b4f0eb85c1728a65ee2020 On require, index.js loads./vendor, whose top-level init fetches a platform-specific native binary from runtime-assembled Cloudflare Workers hosts...

Malicious code in devplatform-cli-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade On require of the package, index.js loads compat.js which reconstructs destination hostnames from split string arrays e.g...

MAL-2026-12700 Malicious code in devplatform-cli-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade On require of the package, index.js loads compat.js which reconstructs destination hostnames from split string arrays e.g...

Malicious code in devplatform-select-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7e22a3a99d2447b8bc3e6c0b1f4a92077ce570fdacff421e9fdee6a83e723 On require, the package loads bridge.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers mirrors...