MAL-2026-13726 Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

MAL-2026-13721 Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

MAL-2026-13674 Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56afa18eac7769497f21431af2a739dd5040563541223e41786746e0c44957a2 Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetching remote content, no...

MAL-2026-13675 Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbd4923fdddd3bf528bfd2bc560ffe7963b22ed9df844e60f6fe2f778f15720 Package [email protected] contains only two files and shows no code performing credential access, network...

MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

MAL-2026-13671 Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd82004d1cbf2e4b6a3c77f48293b0d9638fe59592eb40291b6a332121f6fe6 Package contains no code paths that read installer secrets, fetch and execute remote content, relay caller data to third-party destinations, or...

Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56afa18eac7769497f21431af2a739dd5040563541223e41786746e0c44957a2 Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetching remote content, no...

Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd82004d1cbf2e4b6a3c77f48293b0d9638fe59592eb40291b6a332121f6fe6 Package contains no code paths that read installer secrets, fetch and execute remote content, relay caller data to third-party destinations, or...

Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbd4923fdddd3bf528bfd2bc560ffe7963b22ed9df844e60f6fe2f778f15720 Package [email protected] contains only two files and shows no code performing credential access, network...

MAL-2026-13673 Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f33793b44bee99cf40ae7b4ecfdd4d8ab388edf96753862f96b289ad3e95d2 Package contains only 2 files and no code patterns indicating credential access, network exfiltration, install-time code execution, silent relay, or...

MAL-2026-13672 Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4836c93e5c62158ffed799c206fa3713291692e10efae048c04fff0745f7070f Package [email protected] contains no code patterns matching known supply-chain attack fingerprints. N...

MAL-2026-13677 Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

MAL-2026-13679 Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

EUVD-2025-27054

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...

Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

MAL-2026-13678 Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...