Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11461 Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

Malicious code in famshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25590ceaca7a7491267e3152f276e90e1d5dd7eee7f3a86bee0c2b7666c0427 No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral evidence in either signal...

MAL-2026-11366 Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

MAL-2026-11178 Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

MAL-2026-11168 Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions Summary The createTokenFromRefreshToken function oidcservice.go:451 validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before...

GHSA-W6P7-2FXX-4F44 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions Summary The createTokenFromRefreshToken function oidcservice.go:451 validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before...

Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...

MAL-2026-11096 Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...

Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497 The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoParseDate function invokes...

Malicious code in txs-random-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9f40781ae94116a5e9e1fb190897b78899c9e66abd10f1eb63216b78e986953 Package [email protected] was inspected but no concrete a static rule matches or traced-code findings are available for this verdict. The behavior...

MAL-2026-11092 Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...