Malicious code in lib-frontsga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...

MAL-2026-13449 Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

Exploit for CVE-2026-70553

CVE-2026-70553 - MaxSite CMS Unauthenticated RCE !CVEhttp...

CVE-2026-19041 MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...

CVE-2026-19041

The CVE-2026-19041 entry impacts MissionSquad mcp-api up to version 1.11.8. The vulnerability resides in the function this.packageService.installPackage within src/controllers/packages.ts (NPM Package Version Handler) and enables command injection. Exploit appears possible remotely, with a remedi...

CVE-2025-9266 Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

EUVD-2025-210641

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

MAL-2026-13369 Malicious code in kepler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...

Malicious code in kepler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...

MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13348 Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

Malicious code in bigops-statements-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316 On require of the package, index.js loads support.js which selects a platform-specific asset path and downloads a binary over HTTPS from a rotating...

Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

MAL-2026-13302 Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

Malicious code in dolyame-boxy-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f index.js unconditionally requires./init at module load time. init.js selects a platform-specific path, fetches an opaque native binary over HTTPS fro...

Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...