Malicious code in devplatform-sdk (npm)

Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from string-concatenated Cloudflare Workers hosts...

Malicious code in ded-ps-events-ded-ps-events-core (npm)

Source: amazon-inspector 38b1237ac35f64b35ae902019d79b84aeb8eacafc07339fcbca0de866dc6b797 index.js unconditionally requires./setup.js on load. setup.js assembles hostnames at runtime via Array.join"" to hide them from static scanners, resolving to four Cloudflare Workers endpoints...

Malicious code in claims-get-base-url (npm)

Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path linux/darwin/win32, downloads a binary over HTTPS from...

Malicious code in claims-block-visibility (npm)

Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint, downloads a binary from one of several...

Malicious code in checkout-mobile-promocode (npm)

Source: amazon-inspector f8b1a15a2100e63737bf9fdc85ec750761a4e58b07f961d8a5734a6f99626026 On require, index.js loads vendor.js which reconstructs destination hostnames from split string literals e.g. "oob-worker.c","f102-baf.worker","s.dev".join"" and 'sdk.d','l.w','el1.ru'.join"" to hide them fr...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in capacity-capacity-core (npm)

Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

PT-2026-94311

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.3 through 3.11.6 Description When the crypto builtin is allowed, the host Node.js crypto module is exposed to a NodeVM sandbox. Although the module is presented via a recursive read-only proxy, its callable exports still...

PT-2026-94310

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.3 through 3.11.6 Description When the builtin: '' configuration or explicit permission is granted, the host node:sqlite module is exposed to code running in NodeVM. Although the module is wrapped with vm.readonly to prevent...

CVE-2026-63336 vulnerabilities

Vulnerabilities for packages: traccar, logstash, nuxeo, zipkin, logstash-fips, druid, cassandra-reaper, thingsboard, traccar-fips, conductor, conductor-fips...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-74872 openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

PT-2026-89054

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14 Description The Zstd.trainFromBufferDirect function fails to validate the samples buffer capacity. An attacker can provide crafted sample length arrays with oversized per-sample lengths, causing the native...

Malicious code in @workoscalifant/sudoku-term (npm)

Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint with '--selftest' on every Linux x64 installer. The shipped...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under oob-worker.cf.workers.dev and, on failure, reassembles the...

Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b5dcef9a8613b9de1b3bbd1137a65cdbf087a9a96543602fb3372d7eca978f On require of this package, index.js loads./loader.js which reconstructs C2 hostnames via array-join string concealment...

Malicious code in dolyame-ui-scrollblock (npm)

Source: amazon-inspector 242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9 On require of the package, index.js loads helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments 'oob-worker.cf100','-416.work','ers','.de','v'.join'' and...

Malicious code in dolyame-ui-inputsecure (npm)

Source: amazon-inspector c4fa9effd850891eced167c6313a3e722c359890792d59446d9f28f7898bd4a0 On require of the package's main entry, shim.js and lib/telemetry.js fetch a platform-specific executable from obfuscated Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-clickoutsidehoc (npm)

Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g. "oob-work","er.cf100-416.workers",".dev".join"" and 'sd','k.dl.wel1.r','u'.join"",...