@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70603 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70603 Source advisory: OSV:GHSA-5C9J-MHMV-5XGX...

MAL-2026-13342 Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70598 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70598 Source advisory: OSV:GHSA-PFMC-3MGC-P6FP...

MAL-2026-13295 Malicious code in dolyame-boxy-atom-desktop-bnpl-highlighted-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539999c456d5c8a3f5e2028b9bd7a0f8ca3ab41af3c67044ef7735e0c9f76845 On require, polyfill.js selects a platform-specific payload, fetches an executable from one of three Cloudflare Workers hosts whose names are assembl...

MAL-2026-13313 Malicious code in dolyame-boxy-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6 On require of the package's main entry, runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains...

Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...

MAL-2026-12831 Malicious code in bigops-alerts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284 On require of bigops-alerts-widget, vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one ...

Malicious code in bigops-alerts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284 On require of bigops-alerts-widget, vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one ...

Malicious code in bigops-timers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3857e871cb391df75568052701aae6a172eedcee963519c5e6ac9feeff9cbb On require of bigops-timers, index.js loads compat.js which downloads a platform-specific binary from Cloudflare Workers hosts...

Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in bnpl-blocks-atom-bnpl-anchor-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c841de8c355f3970534d5ec0f0c5eb63ed72a4d70f8d715c2e781c276acdb20 On require of bnpl-blocks-atom-bnpl-anchor-menu, index.js loads loader.js which assembles hostnames from split-string arrays evading static analysis,...

MAL-2026-12863 Malicious code in bnpl-blocks-atom-bnpl-anchor-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c841de8c355f3970534d5ec0f0c5eb63ed72a4d70f8d715c2e781c276acdb20 On require of bnpl-blocks-atom-bnpl-anchor-menu, index.js loads loader.js which assembles hostnames from split-string arrays evading static analysis,...

MAL-2026-12878 Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6823826cd3999be6c3dac95d5731bbce9bee98ae0b7df019a3b85c97fd5d1bad The package is advertised as a UI footer component but side-loads bridge.js on require. bridge.js selects a platform-specific asset linux/darwin/win3...

MAL-2026-13264 Malicious code in devplatform-sre-devplatform-sre-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8 On require of this package, index.js loads helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudfla...

Malicious code in devplatform-sre-devplatform-sre-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8 On require of this package, index.js loads helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudfla...

CVE-2026-67623

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

MAL-2026-12702 Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...