Malicious code in dws-frontend-dws-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb73f65c18cf45f29f533ef6b9ab1278412909686c0750018f9d35170ed39f2 On require of this package, index.js loads support.js which downloads a platform-specific binary over HTTPS from author-controlled hosts under...

Malicious code in candy-candy-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joinin...

MAL-2026-12585 Malicious code in checkout-pay-widget-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare...

Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via array-join to evade static analysis e.g...

Malicious code in @equansservices/setup (npm)

Source: amazon-inspector b071598889a04c74a8398157555ccfffda5bbc713429df4cafbcf48df7f811af package.json declares a postinstall hook node setup.js that fires automatically on npm install. setup.js selects a platform-specific target and fetches an archive over plain HTTP from...

Malicious code in @gleamkit/ws (npm)

Source: amazon-inspector 8fc9213fe9e786988b3fd882b571f03aeaa1487b8006badb837b4e804da66eee The package publishes under scope @gleamkit/ws while copying the ws package's description, homepage, repository, author, and README verbatim, and bundling the legitimate ws source so it appears functional...

Reprise License Manager 14.2 Remote Binary Execution

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44153 Vulnerability Title: Authenticated Remote Binary Execution Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-25...

Reprise License Manager 14.2 Remote Binary Execution Vulnerability

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44153 Vulnerability Title: Authenticated Remote Binary Execution Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Introduction: Whe...

DWebPro 8.4.2 Remote Binary Execution / File Inclusion

Exploit Title: DWebPro 8.4.2 Remote Binary Execution Date: 01/10/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Author twitter: @tulpasecurity Vendor Homepage: http://www.dwebpro.com/ Software Link: http://www.dwebpro.com/download Version: 8.4....