54 matches found
skillscript v0.40.1
Safe, reusable automation authored by agents. skillscript.ai • docs TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. See Quickstart. What is Skillscript? Skillscript came from asking: what would a Makefile look like if it built skills instead of binaries? The...
Malicious code in modsync (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...
MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...
MAL-2026-12852 Malicious code in bigops-umf-statist (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7 On require'bigops-umf-statist', index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from...
Malicious code in @nasddatax/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...
Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...
MAL-2026-12214 Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...
Malicious code in tinkoff-pfp-atom-styles-tiles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...
CVE-2026-46621 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the...
CVE-2026-61643
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow...
MAL-2026-6578 Malicious code in layerd-unit-codec-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca65bb450fc2f4d4596fbcc2ddd81af358c2d02f94d965b18e532d8afa62ef5f The package presents itself as a CSS selector parser src/selector-parser.js re-exports postcss-selector-parser; keywords postcss/selector/parser/css,...
MAL-2026-6326 Malicious code in web3-eth-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a262e70316cd74a87b043cd1985e456639781763d4a3ef69aa09d99a2795154 Package name, README, repository URL, contributors, and module structure are copied from the legitimate '@ethereumjs/util' / 'ethereumjs-util' packag...
Malicious code in new-ts-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3721ae4cecdfa22793382d07d28a25ba5fabd54ac405cb94e642a1f96faee80 index.js imports childprocess and at lines 101 and 117 invokes execSync to run bash and zsh commands. Lines 9, 194, and 195 use Buffer.from...,...
MAL-2026-5980 Malicious code in gpu-accelerator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab0d6b253674f5eef505fbffb76003d2071569fd9d8abdf8993197738bb27759 The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is a 3-line walkDecls that ad...
MAL-2026-5395 Malicious code in @sql-trigger/nodesql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39e37d95fb040c83277583e2bf90b56363f86360337f1c30e63c85eb56579ada The package advertises itself as a simple SQL helper but its main entry index.js is heavily obfuscated obfuscator.io string-array + RC4 + base64,...
MAL-2026-5219 Malicious code in autotel-drizzle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed16d2715633927ef05b9b370a8d37f95581137f46144053bcb53f94430f2f33 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-49185
The CVE-2026-49185 entry concerns FieldX MDM where the adb messaging topic passes unverified payloads directly into Runtime.exec(), enabling command/instruction injection. Affected component: adb messaging topic within FieldX MDM; root cause is unverified payloads executed via Runtime.exec(). Imp...
EUVD-2026-34199
The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec, allowing command/instruction injection...
