MAL-2026-13030 Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

Malicious code in boxy-scroll-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c713e8e4ae3018f2614b7185c98b1f86dffcb684387e6a454d30a2c6eb8b89db On require of boxy-scroll-providers, index.js loads bootstrap.js which selects an OS-specific endpoint, downloads an opaque binary from obfuscated...

Malicious code in boxy-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfb29953971bb0c3eae94e97f7a9efe132bd4a954252ae52c989f990f389d098 index.js unconditionally requires./setup.js on module load. setup.js assembles Cloudflare Workers hostnames from split-string arrays...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

MAL-2026-12546 Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

MAL-2026-12668 Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...

Malicious code in strath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239 The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then...

MAL-2026-12805 Malicious code in strath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239 The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then...

CVE-2026-7456

The Udimi Tools plugin for WordPress (versions

CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2026-71285

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

MAL-2026-12671 Malicious code in dc-renewals-layout2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113 The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the...

Malicious code in dc-renewals-layout2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113 The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the...

MAL-2026-12815 Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...

Malicious code in npm-groat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1 [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to...

MAL-2026-12798 Malicious code in npm-groat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1 [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to...