Malicious code in claims-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009 The package's index.js requires bootstrap.js on import. bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments...

Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

MAL-2026-12617 Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...

Malicious code in claims-historical-claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 821551bfee1b6a8fa74b001808fad75327d22654f228600f02a6130edc31ce2e On require, index.js loads bridge.js which selects a platform-specific URL path and downloads a binary via https.get from hostnames assembled by...

MAL-2026-12627 Malicious code in claims-jira-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666343795502690c0582b4b73652c215ad8f5025ca586d255e94910e8dd59744 On require'claims-jira-service', index.js loads ext.js which downloads a platform-specific executable from author-controlled hosts assembled at runti...

MAL-2026-12647 Malicious code in claims-use-callback-once (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1 On require of claims-use-callback-once, index.js unconditionally loads shim.js which selects a platform-specific payload path, fetches an executable...

MAL-2026-12664 Malicious code in constructor-blocks-renderer-mailings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b9c524160eaa76ac80781bfc28ed9e3f3b54295360d8f21989724a1dd34d34 On module load, index.js requires./bridge.js, which reassembles hardcoded C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in constructor-blocks-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a...

Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

Malicious code in delivery-ci-pipeline-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48367fe7933e3c07d664eda305a21bd8de43e06c685170b2146da16249bde15c index.js unconditionally requires init.js on load. init.js assembles attacker-controlled hostnames from split string fragments joined at runtime e.g...

MAL-2026-12678 Malicious code in delivery-ci-pipeline-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48367fe7933e3c07d664eda305a21bd8de43e06c685170b2146da16249bde15c index.js unconditionally requires init.js on load. init.js assembles attacker-controlled hostnames from split string fragments joined at runtime e.g...

Malicious code in delivery-ci-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...

MAL-2026-12686 Malicious code in delivery-ci-upgrade-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64,...

Malicious code in devplatform-api-v2-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f78874e3ff64b85f64b75f0481a7cadc00f15dea7b4f0eb85c1728a65ee2020 On require, index.js loads./vendor, whose top-level init fetches a platform-specific native binary from runtime-assembled Cloudflare Workers hosts...

Malicious code in devplatform-api-v1-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ed0defa1fbae571985664baae47d89d796f943b249115eb73a38edce04fb6c On require, adapter.js selects a platform-specific asset path and fetches an executable from string-split-obfuscated hosts under...

MAL-2026-12696 Malicious code in devplatform-api-v2-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186e6a9062d157dd85fb6e2ec2fc4a81294569d2cca0c2ade69f2e97075616ed On require of [email protected], index.js loads./polyfill.js, which downloads a platform-specific binary from anonymous Cloudflare...

Malicious code in devplatform-confirm-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68424c7a93599d9d6d9391e3236d1ebf1d88fdc590b9c20f1ee615295335e5e8 [email protected] is advertised as a 'confirm input adapter' but on require executes ext.js, which fetches a platform-specific binary...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

CVE-2026-16071

Affects Keycloak’s LDAP storage provider. The vulnerability arises when a delegated administrator searches with a specific LDAP entry DN; due to missing validation, lookups can target users outside the configured search boundary. This may disclose account information from unauthorized directory p...