MAL-2026-13240 Malicious code in bigops-products-insurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f2dd9bdb83df26b3425759cb4579da8e3a2748a5c995370ce1095c6010abf3c On require, index.js loads ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments...

MAL-2026-13040 Malicious code in boxy-devtools-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 902a7b42df643551615d55958546ab9115082ac8eb60ff1208cafa18b804ab3c The package's main entry index.js unconditionally loads compat.js on require. compat.js assembles a rotating list of Cloudflare Workers hostnames...

curl: heap based buffer overflow in the SOCKS5 proxy handshake

A heap-based buffer overflow flaw was found in the SOCKS5 proxy handshake in the Curl package. If Curl is unable to resolve the address itself, it passes the hostname to the SOCKS5 proxy. However, the maximum length of the hostname that can be passed is 255 bytes. If the hostname is longer, then...