new-native-tools (>=3.1.42-as2-9980-418-1785845663, <=3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-416-1785842977) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.42)

new-native-tools-linux-x64-gnu NPM version 3.1.42 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.42-as2-9980-418-1785845663,...

new-native-tools (>=3.1.43-as2-9980-421-1785848450, <=3.1.43) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.43)

new-native-tools-linux-x64-gnu NPM version 3.1.43 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.43-as2-9980-421-1785848450, =3.1.43 Source cves: unknown CVE Source advisory:...

Malicious code in prokit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92 On require of the package, index.js unconditionally loads helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

MAL-2026-12361 Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

MAL-2026-12381 Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

MAL-2026-12468 Malicious code in streak-math-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...

MAL-2026-12421 Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2 On require, index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

MAL-2026-12304 Malicious code in twork-mf-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c6ce8fa08d31308e00adae0366018f14c4518e234073d99b996212b82cfccd1 On require of twork-mf-sandbox, index.js loads bridge.js which downloads a platform-specific native binary from a rotating list of anonymous Cloudfla...

Malicious code in twork-data-services-proxy-prime-api-v1-account-overdraft-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e5494883e9415a6efbc2775e753d413e111f02709b95688c94e09013dc8db8 On require of this package, index.js loads adapter.js which selects a platform-specific asset path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

MAL-2026-12299 Malicious code in twork-data-services-proxy-prime-api-v1-account-overdraft-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e5494883e9415a6efbc2775e753d413e111f02709b95688c94e09013dc8db8 On require of this package, index.js loads adapter.js which selects a platform-specific asset path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12297 Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...