Malicious code in tailwind-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0 index.js appends an evalatob... blob to an otherwise legitimate Tailwind plugin. On require, the decoded loader queries Ethereum JSON-RPC block...

MAL-2026-11500 Malicious code in tailwind-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0 index.js appends an evalatob... blob to an otherwise legitimate Tailwind plugin. On require, the decoded loader queries Ethereum JSON-RPC block...

Malicious code in tailwindcss-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01f26860cd01782ea3614f8dd2d144ced75af610edac79984c24d67dee41d8a index.js hides a base64-encoded payload after a long run of tab characters and executes it via evalatob... at module load, so any require/import of t...

Malicious code in simple-date-formatter-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e828348e997bf53071c8bc1d24adc305be689a64a56f2ababda6ef9370948d3 The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network activity, no lifecycle script...

Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

MAL-2026-11485 Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

MAL-2026-11483 Malicious code in simple-date-formatter-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e828348e997bf53071c8bc1d24adc305be689a64a56f2ababda6ef9370948d3 The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network activity, no lifecycle script...

Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

Arbitrary File Read

Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...

UBUNTU-CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

EUVD-2026-51853

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67322 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

MAL-2026-11488 Malicious code in test-dev-boot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...

Malicious code in test-dev-boot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...

Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

Malicious code in test-dev-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42ca0e645623ac78190f4921a1d577eeaaeaaca953f6310565db2b981d90b21 The package contains three files and produced no a static rule matches and no traced code behaviors of concern. The name and version pattern suggest ...

Malicious code in test-dev-watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...

Malicious code in test-dev-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6205523817ec8f05eccf82a334fa70429c8c326b73c27e031fe991b9abdbdb The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitrary-path file exfiltration,...

MAL-2026-11493 Malicious code in test-dev-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e03286d5422408fe1567e37542070ac8d0610b319d57e941e3dcb2c28004bfc test-dev-store is a library module of an infostealer toolkit. utils.js exports path builders that specifically target Chrome/Chromium profile...

MAL-2026-11495 Malicious code in test-dev-watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...