Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12050 Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

MAL-2026-12036 Malicious code in bigops-chat-tmsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...

Malicious code in bigops-chat-tmsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...

Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

MAL-2026-12041 Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

sextant-cli (0.0.1-rc33) potentially affected by unknown CVE via sextant-cli-linux-arm64 (0.0.1-rc33)

sextant-cli-linux-arm64 NPM version 0.0.1-rc33 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-linux-arm64 and may be impacted: - sextant-cli 0.0.1-rc33 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12043...

MAL-2026-12054 Malicious code in uibabai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484 index.js has malicious code appended after a legitimate Tailwind plugin export. On any require/import of the package, the appended block queries the...

sextant-cli (0.0.1-rc39) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc39)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc39 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc39 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc9) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc9)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc9 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc13) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc13)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc13 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc13 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc22) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc22)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc22 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc22 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc14) potentially affected by unknown CVE via sextant-cli-linux-amd64 (0.0.1-rc14)

sextant-cli-linux-amd64 NPM version 0.0.1-rc14 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-linux-amd64 and may be impacted: - sextant-cli 0.0.1-rc14 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12029...

sextant-cli (0.0.1-rc36) potentially affected by unknown CVE via sextant-cli-linux-amd64 (0.0.1-rc36)

sextant-cli-linux-amd64 NPM version 0.0.1-rc36 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-linux-amd64 and may be impacted: - sextant-cli 0.0.1-rc36 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12029...

MAL-2026-11999 Malicious code in streak-map-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3 The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a...

sextant-cli (0.0.1-rc13) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc13)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc13 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc13 Source cves: unknown CVE Source advisory: OSV:MAL-2026-11997...

sextant-cli (0.0.1-rc31) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc31)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc31 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc31 Source cves: unknown CVE Source advisory: OSV:MAL-2026-11997...

CVE-2026-66747: Embedded Malicious Code

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...