MAL-2026-10429 Malicious code in @nsub/nitxe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16147b7ac55d6c4cc4e042be73e6d49fc7232e8a03f406fecd034cdd27bf0eb The package's declared npm postinstall script collects the installer's username os.userInfo.username, hostname os.hostname, platform, and the entire...

MAL-2026-10427 Malicious code in svg-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f index.js exports getPlugin, which fetches JSON from the hardcoded endpoint https://svganchordev.net/icons/106 and passes the response field...

MAL-2026-10426 Malicious code in chai-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...

MAL-2026-10414 Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

MAL-2026-10405 Malicious code in @torbeck/heap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads @datastructures-js/heap, package.json sets...

MAL-2026-10413 Malicious code in eth-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...

MAL-2026-10407 Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10293 Malicious code in backupsitetuff6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf0f0345d3aed2a0b5f8f145161679e6ebf492603ce2e99d586903f5b8044c9 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10402 Malicious code in @gleamkit/ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fc9213fe9e786988b3fd882b571f03aeaa1487b8006badb837b4e804da66eee The package publishes under scope @gleamkit/ws while copying the ws package's description, homepage, repository, author, and README verbatim, and...

MAL-2026-10400 Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

MAL-2026-10399 Malicious code in @equansservices/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5e64d3c1e1d799f465001f52813a12ba2cf757ce9ea50c27d184b7549000dc9 @equansservices/codex is a typosquat of @openai/codex it also declares @openai/codex as a dependency to appear legitimate. Its package.json declares ...

MAL-2026-10397 Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

WordPress Simple File List <=4.2.2 - Remote Code Execution

An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint ee-upload-engine.php restricts file uploads based on extension, but lacks proper validatio...

MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

PT-2026-60047

Impact read character string and read string in src/zeroconf/ protocol/incoming.py sliced self.dataself.offset : self.offset + length and advanced self.offset by the declared length without checking it against self. data len. Python's slice silently returns fewer bytes when the end index runs pas...

MAL-2026-10232 Malicious code in salesforce-vscode-slds (npm)

The salesforce-vscode-slds package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a...

Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...