MAL-2026-14247 Malicious code in magika-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cd28e41bc842fd046a2bff254f450edd0b6d2d15d961fe768cf5e9ebfa197f magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...

Malicious code in magika-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cd28e41bc842fd046a2bff254f450edd0b6d2d15d961fe768cf5e9ebfa197f magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...

gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an...

MAL-2026-14246 Malicious code in hardhat-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...

Malicious code in hardhat-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...

Malicious code in github-policy-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b8742a99002975ebaced2478673108f4f442e5ac7878651edeb8346702f132 On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, node version, package name, npm lifecycle eve...

MAL-2026-14245 Malicious code in github-policy-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b8742a99002975ebaced2478673108f4f442e5ac7878651edeb8346702f132 On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, node version, package name, npm lifecycle eve...

Malicious code in gemini-cli-a2a-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...

MAL-2026-14244 Malicious code in gemini-cli-a2a-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...

MAL-2026-14239 Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

MAL-2026-14238 Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in gaarf-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0 On npm install, the package's postinstall lifecycle script collects installer host identifiers os.hostname, process.platform, process.arch, Node...

MAL-2026-14237 Malicious code in gaarf-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0 On npm install, the package's postinstall lifecycle script collects installer host identifiers os.hostname, process.platform, process.arch, Node...

Malicious code in gaarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3312540cdedc807029a549ffd3b49b917704323a3b664c6d71ae6849c192b9 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers os.hostname, platform, arch, Nod...

MAL-2026-14236 Malicious code in gaarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3312540cdedc807029a549ffd3b49b917704323a3b664c6d71ae6849c192b9 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers os.hostname, platform, arch, Nod...

Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

MAL-2026-14235 Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

Malicious code in commandor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d The package's scripts/postinstall.js runs automatically on npm install and imports childprocess alongside http.request with multiple POST call sites...