CVE-2026-71430 node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

CVE-2026-71430 node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

MAL-2026-13465 Malicious code in vite-vue-path-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6841df6c82f556057129d7bf3f23a6cccff9da407678d980875c5529e40caa9 The package is advertised as a Vite plugin that generates a local pathInfo.json map, but its generateBundle hook appends obfuscated JavaScript to the...

Malicious code in opencode-optimised-toolings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...

MAL-2026-13452 Malicious code in opencode-optimised-toolings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...

Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks

Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it's thought that passkeys will replace passwords entirely. But what happens when malware steals the...

CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

EUVD-2026-53178

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

MAL-2026-12102 Malicious code in @wethenorth12/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d27d76902370899c3362602581cdec59396e1ece2bd87976f1798083957f89 On require of the package's main entry index.js, the code collects process.env, hostname, username, homedir, platform, cwd and a timestamp,...

Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...

Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

MAL-2026-12107 Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

Malicious code in @wethenorth12/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2 @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home...

MAL-2026-12094 Malicious code in @wethenorth12/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8 The package presents itself as a drop-in replacement for the ethers library author metadata ethers-io, repository URL pointing at the legitimate ethe...

MAL-2026-12096 Malicious code in @wethenorth12/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da index.js runs at require time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes...

Malicious code in @wethenorth12/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da index.js runs at require time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes...

MAL-2026-12098 Malicious code in @wethenorth12/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec76b158cd4b27bb2e90a492c1713c1655dcbd2f4a9fc0f03a0664d8bec8e2ed Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require'near-api-js' if installed. On requir...

Malicious code in @wethenorth12/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec76b158cd4b27bb2e90a492c1713c1655dcbd2f4a9fc0f03a0664d8bec8e2ed Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require'near-api-js' if installed. On requir...

Malicious code in @wethenorth12/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions createWallet, generateMnemonic to attract...