EUVD-2026-54481

An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541

Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541. Vulnerability Details CVEID:CVE-2026-56745 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through...

MAL-2026-13547 Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

MAL-2026-13552 Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reac...

MAL-2026-13596 Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in dolyame-ui-deprecatepropshoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226 On require, [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from...

Malicious code in dolyame-ui-inputcount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four...

Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

Malicious code in platform-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023 On require of platform-ui-colors, both the declared main lib/telemetry.js and helpers.js fetch an opaque binary from author-controlled Cloudflare...

MAL-2026-13561 Malicious code in dolyame-ui-contextmenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

Malicious code in dolyame-ui-contextmenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-13570 Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

MAL-2026-13553 Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts...

Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

MAL-2026-13554 Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in delivery-ci-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203 On require'delivery-ci-documentation', index.js loads init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames ...