24455 matches found
Malicious code in @vinnxcode/xbailsync (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa85bc699ec69bbebf0799696e784cee3fcd9f78f5ccc9e2cb032e9a9cb3de68 @vinnxcode/xbailsync 1.0.1 is a fork/republish of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to co-occurren...
MAL-2026-11080 Malicious code in @vinnxcode/xbailsync (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa85bc699ec69bbebf0799696e784cee3fcd9f78f5ccc9e2cb032e9a9cb3de68 @vinnxcode/xbailsync 1.0.1 is a fork/republish of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to co-occurren...
MAL-2026-11079 Malicious code in @vinnxcode/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92b886dd14e44e2d8c35f297283b6bf7eb3cc0e947d786130c5fd8976d7ebdc1 Analysis of this package version surfaced no a static rule matches and no traced install-time or import-time behaviors indicating credential theft,...
Malicious code in amanexzyra-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c2dc37b7d123a5de5b204c909ddc35474421dc3e0e7a4f256691a54d825c20 Package name amanexzyra-baileys resembles the popular WhatsApp Web API library @whiskeysockets/baileys family, which has been a frequent target of...
MAL-2026-11081 Malicious code in amanexzyra-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c2dc37b7d123a5de5b204c909ddc35474421dc3e0e7a4f256691a54d825c20 Package name amanexzyra-baileys resembles the popular WhatsApp Web API library @whiskeysockets/baileys family, which has been a frequent target of...
Malicious code in @fazzcode/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f1bff90cd31ad87a8cd76716c0c7fb23b148c5fa1d4ac226ce3ea10ebf70835 @fazzcode/baileys is a fork of @whiskeysockets/baileys that re-exports the upstream makeWASocket API while injecting an undocumented remote-controlle...
MAL-2026-11073 Malicious code in @fazzcode/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f1bff90cd31ad87a8cd76716c0c7fb23b148c5fa1d4ac226ce3ea10ebf70835 @fazzcode/baileys is a fork of @whiskeysockets/baileys that re-exports the upstream makeWASocket API while injecting an undocumented remote-controlle...
Malicious code in fazzgram (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8799da09b9c2cf933d99463789c230da7d238000ba0fde0b311a4050353a6ead fazzgram is a Telegram Bot API wrapper. Supporting modules ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js, Context.js, Markup.js are...
MAL-2026-11086 Malicious code in fazzgram (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8799da09b9c2cf933d99463789c230da7d238000ba0fde0b311a4050353a6ead fazzgram is a Telegram Bot API wrapper. Supporting modules ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js, Context.js, Markup.js are...
EUVD-2026-49396
LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch function src/librawcxx.cpp and fujirotate function src/decoders/fuji.cpp...
CVE-2026-51235
LibRaw 0.21 contains a buffer overflow in the stretch() and fuji_rotate() functions. Red Hat’s advisory states the issue is a vulnerability in the LibRaw library that could allow memory overwrite, potentially leading to denial of service or unauthorized code execution. Mitigation: avoid processin...
PT-2026-65084
LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch function src/libraw cxx.cpp and fuji rotate function src/decoders/fuji.cpp...
CVE-2026-51235
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Malicious code in app-data-lts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f9d67601ec8b46265e1f23f5e48ff5beb050626f4bc156b291cb1b8f8c36d35 package.json declares postinstall node test.js and main: index.js, but index.js is absent from the tarball. test.js executes require'.', which throws...
MAL-2026-11054 Malicious code in app-node-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...
Malicious code in app-node-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...
MAL-2026-11052 Malicious code in app-data-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...
Malicious code in eth-slint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bdbbc1ccc748bfe5ad640ed4e54ed5285a526a78a198ac2bf64727b7730d54d eth-slint is a typosquat of web3-core-subscriptions. src/index.js contains a clean 2119-byte copy of the legitimate web3.js subscriptions module, whi...
MAL-2026-11034 Malicious code in eth-slint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bdbbc1ccc748bfe5ad640ed4e54ed5285a526a78a198ac2bf64727b7730d54d eth-slint is a typosquat of web3-core-subscriptions. src/index.js contains a clean 2119-byte copy of the legitimate web3.js subscriptions module, whi...