MAL-2026-13554 Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in delivery-ci-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203 On require'delivery-ci-documentation', index.js loads init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames ...

Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0 On require of the package, index.js loads bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from...

Malicious code in ded-pwa-c-micro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcod...

MAL-2026-13536 Malicious code in ded-pwa-c-micro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcod...

MAL-2026-13590 Malicious code in dolyame-ui-noindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from...

Malicious code in dolyame-ui-noindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from...

MAL-2026-13598 Malicious code in dolyame-ui-selectaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...

Malicious code in delivery-ci-dpat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f On require of delivery-ci-dpat, platform.js runs setup at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare...

Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13511 Malicious code in dolyame-ui-stateutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcb488491701865d9106e75e576785ff3b4f1d9687e456eb69f1ff69d8a393f On require/import, index.js loads loader.js which fetches an opaque platform-specific binary from one of three obfuscated Cloudflare Workers endpoint...

MAL-2026-13515 Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

Malicious code in eacq-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b500358c69db5b11d186a6656bd7e20b6ae98cf8f8b437af7b320d511f870761 On require of eacq-core, both helpers.js and lib/telemetry.js download a platform-specific binary from Cloudflare Workers hosts assembled at runtime...

Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...

OnionHop v3.7.9

OnionHop V3 OnionHop V3 is a modern, cross-platform desktop app Windows, macOS and Linux that routes your traffic through Tor. It can run Tor as a local SOCKS proxy or as a system-wide tunnel, automatically pick a working connection strategy for your network with Smart Connect , scan and apply...

pocyeah

An open-source project from Pillar Security PocYeah Turn...

EUVD-2026-54137

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

EUVD-2025-210646

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...