MAL-2026-13746 Malicious code in base65-12x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122 The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry...

Malicious code in base65-13x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529 [email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decodestring function in both...

Malicious code in base65-12x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122 The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry...

Malicious code in base65-11x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cc9506a804a2663d0cde1c610fa8cba5733e6797652b6365569ada5ef3901d base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints src/cjs/index.cjs and src/esm/index.js, 127KB each vs. 4KB for rea...

MAL-2026-13745 Malicious code in base65-11x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cc9506a804a2663d0cde1c610fa8cba5733e6797652b6365569ada5ef3901d base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints src/cjs/index.cjs and src/esm/index.js, 127KB each vs. 4KB for rea...

Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

MAL-2026-13700 Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

MAL-2026-13630 Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

CVE-2026-54218

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

CVE-2026-54218 TeamDavid: Weak Cryptography and Insecure Password Storage

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

EUVD-2026-54449

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

CVE-2026-54218

CVE-2026-54218 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue stems from use of a hard-coded cryptographic key and password storage across locally created users in David, where passwords are stored in various files using only obfuscation. If an attacker can access the server’s file s...

Malicious code in fast-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503b750458783954b66f8dea6ee8b0300fd7db5b225280f1af432cf78c1faf6d setup.py defines a custom install command NativeInstall.run that decodes a base64 blob and passes it to execcompile... at install time. The decoded...

MAL-2026-13443 Malicious code in diezyyasha-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745 diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines...

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

MAL-2026-13402 Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

MAL-2026-13392 Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...