MAL-2026-12063 Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

MAL-2026-12071 Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

hermes-decomp v0.2.1

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-12076 Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

Malicious code in bigops-create-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027d25851cc38da61b10c0ce1d722d3e8455826d2f7866474432e98dd8f1b806 On require, index.js loads polyfill.js which selects a platform-specific endpoint, downloads an opaque native binary over HTTPS from one of several...

MAL-2026-12037 Malicious code in bigops-create-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027d25851cc38da61b10c0ce1d722d3e8455826d2f7866474432e98dd8f1b806 On require, index.js loads polyfill.js which selects a platform-specific endpoint, downloads an opaque native binary over HTTPS from one of several...

Malicious code in tui-react-mobile-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js...

MAL-2026-12053 Malicious code in tui-react-mobile-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

MAL-2026-12046 Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12050 Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

PT-2026-68956

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

PT-2026-68287

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.9 Electron versions prior to 40.9.2 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3 Description The DevTools reveal in file manager action could launch a target file instead of simply...

CVE-2026-70611: Improper Neutralization of Special Elements used in an OS Command

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...