Malicious code in typescriptt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023f754538f603fbb5379ee8be82cb9524f710495e5dddc4e631e5aafbf323b5 typescriptt-cli is a typosquat of typescript-cli whose index.js is an empty module; its only real behavior is in scripts/postinstall.js. On npm...

MAL-2026-14144 Malicious code in tyepescript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862 Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arra...

Malicious code in tyepescript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862 Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arra...

MAL-2026-14145 Malicious code in typecript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03604fc37a8607bf5c14f409dc9d13308bff3e7ec145de955ae13a07c13da92e [email protected] is a typosquat of 'typescript' whose scripts/postinstall.js performs an install-time dropper attack. Payload strings are stored a...

Malicious code in typecript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03604fc37a8607bf5c14f409dc9d13308bff3e7ec145de955ae13a07c13da92e [email protected] is a typosquat of 'typescript' whose scripts/postinstall.js performs an install-time dropper attack. Payload strings are stored a...

Malicious code in typescipt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b97af3a328b837904c7860b7acbae33bea28afb53949905868867905c14be6 Package name typosquats typescript. The postinstall script scripts/postinstall.js XOR-decodes a download URL and a PowerShell launcher using key...

MAL-2026-14147 Malicious code in typescipt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b97af3a328b837904c7860b7acbae33bea28afb53949905868867905c14be6 Package name typosquats typescript. The postinstall script scripts/postinstall.js XOR-decodes a download URL and a PowerShell launcher using key...

Malicious code in typescipt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29 Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: 1 POSTs a JSON body with the installer's platform label to...

MAL-2026-14146 Malicious code in typescipt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29 Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: 1 POSTs a JSON body with the installer's platform label to...

Malicious code in tyepescript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a867a5fc578cb6dcb759370e837d1a4c7e24f6db63c0c0f781e2c24995905e6 tyepescript-cli is a typosquat of typescript. Its scripts/postinstall.js XOR-decodes key stf2026 a set of obfuscated byte arrays that resolve to an...

MAL-2026-14143 Malicious code in tyepescript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a867a5fc578cb6dcb759370e837d1a4c7e24f6db63c0c0f781e2c24995905e6 tyepescript-cli is a typosquat of typescript. Its scripts/postinstall.js XOR-decodes key stf2026 a set of obfuscated byte arrays that resolve to an...

MAL-2026-14136 Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

CVE-2026-52854

The MediaWiki Maps extension (versions before 12.1.3) is vulnerable to stored XSS: the display_map parser function's overlays parameter passes unescaped overlay names to Leaflet's layer-control label code, enabling script execution in any viewer's browser. A PoC exists using {{#display_map:0,0|se...

EUVD-2026-62200

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...