MAL-2026-12152 Malicious code in bigops-auth-provider-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7 On require, bigops-auth-provider-interceptor loads init.js, which reconstructs destination hostnames via string-split/join...

CVE-2026-71206 shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

CVE-2026-71206

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or...

MAL-2026-12114 Malicious code in streak-calc-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7 [email protected] bundles a Linux x8664 ELF at dist/math-calc.bin and launches it unconditionally when the package is imported. The top-level II...

Malicious code in streak-calc-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7 [email protected] bundles a Linux x8664 ELF at dist/math-calc.bin and launches it unconditionally when the package is imported. The top-level II...

MAL-2026-12084 Malicious code in @ccfly/setup-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and...

Malicious code in @ccfly/setup-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and...

Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

MAL-2026-12115 Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

Malicious code in streak-day-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch,...

MAL-2026-12047 Malicious code in streak-day-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch,...

MAL-2026-12002 Malicious code in streak-metricsazb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2 On import of the package's main entry, a top-level async IIFE in index.mjs labelled 'ENGINE INITIALIZATION & CALIBRATION' copies the shipped file...

Malicious code in streak-metricsazb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2 On import of the package's main entry, a top-level async IIFE in index.mjs labelled 'ENGINE INITIALIZATION & CALIBRATION' copies the shipped file...

Malicious code in streak-metricazbd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF dist/math-core.bin to /tmp/sm-engine-runtime/math-core.bi...

MAL-2026-12003 Malicious code in streak-test-mathcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1 Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via childprocess.spawn on any import of the package. The bundled ELF...

Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

MAL-2026-12000 Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

CVE-2026-39924: Insufficient Session Expiration

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...