MAL-2026-12700 Malicious code in devplatform-cli-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade On require of the package, index.js loads compat.js which reconstructs destination hostnames from split string arrays e.g...

MAL-2026-12706 Malicious code in devplatform-cra-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940 On require'devplatform-cra-template', index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one ...

MAL-2026-12738 Malicious code in devplatform-react-query-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints...

MAL-2026-12744 Malicious code in devplatform-rest-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8 On require'devplatform-rest-client', index.js loads init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudfla...

Malicious code in devplatform-spa-plugin-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12808 Malicious code in streak-metric-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d85f4f43ac36e53cc3254c7e5050d63105543deb781c8884046b7f5443fc3e21 On any require/import of streak-metric-core, top-level code in the main entry reconstructs a URL from String.fromCharCode integer arrays, resolving t...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

Malicious code in alpha-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9758eecca0cf755a3c7cc43115b413dfda31f149bbeed40cdfaeb5e46d739efb The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response...

MAL-2026-12325 Malicious code in @nextco/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2af3efee911b20157dcf0e84f2be91affddf4e34aac298e1959ea7090f08c4d2 On require, index.js unconditionally calls a telemetry function at module top level that collects host reconnaissance hostname, username, dirname, cw...

MAL-2026-12394 Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

Malicious code in npm-module-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026 The default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

MAL-2026-12404 Malicious code in npm-module-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026 The default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

MAL-2026-12431 Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

MAL-2026-12371 Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

Malicious code in pfp-forms-sme-loan (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

MAL-2026-12442 Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

MAL-2026-12393 Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...

Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...

MAL-2026-12467 Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...