Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12297 Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12308 Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

MAL-2026-12210 Malicious code in statist-browser-typed-client-investing.product.loginandauthorization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508b23be5504ec69bf284c9a99bb7840e284c52862e07588b07807ebc4f0d71c index.js unconditionally requires./bridge on load. bridge.js selects a per-OS binary URL from a list of string-split-concealed hosts...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db9a5313417dcbe6f8514736de7dd82892ad5cdccc261e0064d8f76f8d9613e On require, index.js loads platform.js, which reconstructs C2 hostnames via runtime string concatenation joining fragments such as...

Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12247 Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in tinkoff-statist-browser-typed-client-sme.users.origination.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bfbb507be06c5d117ac6bfdff47a2441c2198b0d5702e4da97f598bc0d880a3 The package's main entry require's loader.js, which at import time downloads a per-platform binary from string-concatenation-obfuscated Cloudflare...

MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12068 Malicious code in ledger-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 440db517e7261bf345aa374ab2afb8d91698929115a8d3d67abd9fbf7018362e The npm package [email protected] presents itself as a Ledger hardware wallet library but ships no wallet functionality index.js is empty. Its...

Malicious code in tramvai-tinkoff-module-legacy-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c940ade7f46d36a0ef00f120e2c6422c6ebc810c36429935ffd538da25bf1b On require of tramvai-tinkoff-module-legacy-popup, index.js loads setup.js, which selects a platform-specific payload from a hardcoded binary map,...

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

Malicious code in @umacloud/cli-linux-x64 (npm)

npm/@umacloud/cli-linux-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in umadev (npm)

npm/umadev is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the worm...

MAL-2026-11957 Malicious code in @umacloud/cli-linux-musl-x64 (npm)

npm/@umacloud/cli-linux-musl-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...