MAL-2026-14120 Malicious code in blastradar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eccd07c931ee578e1201f5fbb7f4610fd5291202c0fcee2b30c959c80c871e The package's index.js loads childprocess, https, and fs at the top level and performs an HTTPS POST that carries host- and installer-identifying dat...

Malicious code in sui-move-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760bce82610adadda6538b9ab04627b71b66c3816fe63f8e1a8f629ce4b4aaf4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14122 Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

Malicious code in bcs-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd676f5c862ca8046400db51b6ccdc4eea5c3fa913548c1eb7679a22653a3f05 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sui-move-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cceb15de1ddd23a55de69afe59a00c79dcc23f8ce3dfed33592d781bddfbb5a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14109 Malicious code in leb128x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3862797564b06cd20320cecbdadcdd30bd5506e9afc09ed1f2ce225c22e5c8 The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires perf.js, which on load reads /.sui/sui.keystore,...

Malicious code in sui-gql-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd108608caad4cab6ceb193a4711e40f7007114ddd01bcd5b8c3a958c1c70520 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14112 Malicious code in sui-gql-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd108608caad4cab6ceb193a4711e40f7007114ddd01bcd5b8c3a958c1c70520 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in leb128x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3862797564b06cd20320cecbdadcdd30bd5506e9afc09ed1f2ce225c22e5c8 The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires perf.js, which on load reads /.sui/sui.keystore,...

Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14111 Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14106 Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in a.poltoradnev-package-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d1659d9d1386305bd1c623cc2e3643375f4e14ad279ece4f3df684ecd53ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14103 Malicious code in a.poltoradnev-package-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d1659d9d1386305bd1c623cc2e3643375f4e14ad279ece4f3df684ecd53ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @siwatfa/yorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14070 Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...