MAL-2026-12263 Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4 index.js requires./polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008 Requiring this package triggers support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd094a1c3c67af1fc7372e62ed565847fcf26962f3b90e53a5df200390c07a99 On require/import, index.js loads bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded...

MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-12216 Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12141 Malicious code in beaver-ui-actions-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daeb30fbebca53883598794ed1662b3d15aca34b78d29257a477431a47201fd The package is published as a React components library but ships no React code. On library load, index.js auto-requires setup.js, which constructs...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

MAL-2026-12187 Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Malicious code in accounts-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on...

Malicious code in simple-date-formatter-util-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd747d615be16a4af8508b6151d829c49f8ba2e1d045b8c1cbc9d8f2f219de9 package.json declares a postinstall script that, on npm install, collects installer reconnaissance id, hostname, uname, cgroups, docker.sock, Linux...

MAL-2026-12202 Malicious code in simple-date-formatter-util-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe9863d2e47d22ca16f42efd68d0c79e0b2730b48984bf68b040f6f920fb70ec Package presents itself as a date-formatting utility index.js is a four-line toLocaleDateString wrapper but its package.json postinstall hook runs an...

Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...

MAL-2026-12197 Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...

Malicious code in simple-date-formatter-new-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824 Package is advertised as a date-formatting utility but its postinstall script probes an internal-range Kubernetes API 10.45.196.138:8080, endpoints...

MAL-2026-12196 Malicious code in simple-date-formatter-new-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f5ed3c402677fcfaeac396b55b9db5280445e9b0130133cc311a83f96f2a0de Package advertises itself as a date-formatting utility but its actual behavior on install is credential theft and internal-network reconnaissance. Th...

MAL-2026-12120 Malicious code in @zzzgenesis00/env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfbfc9bcbea1e1b9d6c52e2585bf5b28064fe8e38fe53304450fe1fd19340f3b On npm install, postinstall.js reads installer-owned secret material — /.ssh entries, /.npmrc, /.gitconfig — and iterates a curated list of credentia...

MAL-2026-12118 Malicious code in @zzzgenesis00/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439 @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to...

Brave Desktop 1.93.132 Security Fixes

Added validation for Tor bridge list as reported on HackerOne by z3phyrus. - Fixed Widevine install prompt as reported on HackerOne by syarif07. Upgraded Chromium to 151.0.7922.76 — refer to Google Chrome advisories for inherited CVEs...