MAL-2026-12041 Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

sextant-cli (0.0.1-rc33) potentially affected by unknown CVE via sextant-cli-linux-arm64 (0.0.1-rc33)

sextant-cli-linux-arm64 NPM version 0.0.1-rc33 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-linux-arm64 and may be impacted: - sextant-cli 0.0.1-rc33 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12043...

MAL-2026-12054 Malicious code in uibabai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484 index.js has malicious code appended after a legitimate Tailwind plugin export. On any require/import of the package, the appended block queries the...

sextant-cli (0.0.1-rc39) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc39)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc39 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc39 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc9) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc9)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc9 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc22) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc22)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc22 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc22 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc13) potentially affected by unknown CVE via sextant-cli-darwin-amd64 (0.0.1-rc13)

sextant-cli-darwin-amd64 NPM version 0.0.1-rc13 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-amd64 and may be impacted: - sextant-cli 0.0.1-rc13 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12028...

sextant-cli (0.0.1-rc14) potentially affected by unknown CVE via sextant-cli-linux-amd64 (0.0.1-rc14)

sextant-cli-linux-amd64 NPM version 0.0.1-rc14 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-linux-amd64 and may be impacted: - sextant-cli 0.0.1-rc14 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12029...

sextant-cli (0.0.1-rc36) potentially affected by unknown CVE via sextant-cli-linux-amd64 (0.0.1-rc36)

sextant-cli-linux-amd64 NPM version 0.0.1-rc36 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-linux-amd64 and may be impacted: - sextant-cli 0.0.1-rc36 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12029...

MAL-2026-11999 Malicious code in streak-map-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3 The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a...

sextant-cli (0.0.1-rc13) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc13)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc13 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc13 Source cves: unknown CVE Source advisory: OSV:MAL-2026-11997...

sextant-cli (0.0.1-rc31) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc31)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc31 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc31 Source cves: unknown CVE Source advisory: OSV:MAL-2026-11997...

CVE-2026-66747: Embedded Malicious Code

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...

Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

MAL-2026-11538 Malicious code in eacq-payform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...

Malicious code in eacq-payform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...

Malicious code in discord-vibegrations-api-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6 The package declares a postinstall lifecycle hook postinstall: node postinstall.js that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to...