EUVD-2026-54420

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

CVE-2026-8400

CVE-2026-8400 affects IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server Liberty Continuous Delivery. The issue is in the ORB component of IBM SDK, Java Technology Edition, where a malicious IIOP server could cause loading and instantiation of arbitrary classes, enabling ...

CVE-2026-8400 Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

EUVD-2026-53438

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

MAL-2026-12750 Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

MAL-2026-12781 Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

Malicious code in shift-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aca555e012d36b30d9ffe3d0f8acdca7ba67298a87ea02ea9d32731e8f2a748 [email protected] registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, username, SUDOUSER, home...

MAL-2026-12409 Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12312 Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

Malicious code in tcb-web-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69 On require'tcb-web-images', index.js loads helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads ...

MAL-2026-12442 Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

Malicious code in saas-f-lego-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...

Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

Malicious code in uniswap-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with th...

MAL-2026-12475 Malicious code in tcb-web-copy-to-clipboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes...

MAL-2026-12440 Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

Malicious code in tinkoff-component-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e6bc0aab20cfeb6b8faa38c382fbf50d7675b65b0a56eea0977c45ae59ee7d7 The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require, index.js loads shim.js, which selects a...