MAL-2026-12239 Malicious code in tinkoff-component-page-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6470a0a8983b764a0df6ac4b4f5945f0941e724877192033dace84d55b65fab On require of the package, index.js loads platform.js which unconditionally invokes a setup routine that downloads a platform-specific binary from...

Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

MAL-2026-12149 Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

SUSE CVE-2026-41646

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require function, bypassing the default local file acce...

Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

MAL-2026-11136 Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

Exploit for Deserialization of Untrusted Data in Facebook React

Tìm hiểu về React Server Components và giao thức Flight REac...

CVE-2026-63988 bridge: Fix sleep in atomic context in sysfs path

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brportstore always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its...

CVE-2026-63818

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fsrecoverorphaninodes trusts the orphan block entrycount when replaying orphan inodes from the checkpoint pack. A corrupted entrycount larger than F2FSORPHANSPERBLOCK makes the recovery...

MAL-2026-10677 Malicious code in deployowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b875dd11198fbfc694fe8b3227090e95f13734b5cf64556c6c727b48d7471035 The SDK's captureSnapshot iterates Object.entriesprocess.env and attaches every environment variable to every captured error, then POSTs the payload ...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

MAL-2026-10591 Malicious code in solana-key-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92 On require, index.js waits 37 seconds, reads test/fixtures/keypairs.dat a 53KB base64 blob disguised as a test fixture, no test harness references it...

MAL-2026-10530 Malicious code in cbr-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...

MAL-2026-10545 Malicious code in vite-plugin-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50d2f5d3fe93de908c3da2d129b5b766a740b16a0eebf6c29c684605a9eaccf3 The CJS entrypoint dist/index.js top-level requires bytenode and loads a sibling V8 bytecode blob dist/index.jsc, then injects a hidden Model.resetor...

MAL-2026-10504 Malicious code in chai-as-verified (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fece219fd09d83bc6a41135483cf3ce8cd2769c22e7776c22d0eb97d65852dd5 Package name typosquats chai-as-promised while its package.json advertises unrelated logger/vulnerability-management metadata. On require, index.js...

MAL-2026-10471 Malicious code in loading-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94 Package name impersonates the pino logger exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js,...