1103 matches found
Malicious code in bigops-frontend-bigops-frontend-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb3c97636fded3935088ac125f923882844470f5638c45176b4254d4dbad714 On require of the package, vendor.js downloads a platform-selected native binary from hardcoded Cloudflare Workers hosts...
MAL-2026-12168 Malicious code in bigops-frontend-bigops-frontend-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb3c97636fded3935088ac125f923882844470f5638c45176b4254d4dbad714 On require of the package, vendor.js downloads a platform-selected native binary from hardcoded Cloudflare Workers hosts...
Malicious code in bigops-chats (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 322310cb37baed38193c12087a25e40901a781467fc070c1bf078293ca8586be On require of bigops-chats, index.js loads helpers.js which assembles C2 hostnames via array split-join obfuscation oob-worker.cf101-adf.workers.dev,...
MAL-2026-12116 Malicious code in tailwind-hide-scrollbar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...
Malicious code in sotqa-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...
MAL-2026-12069 Malicious code in nxify-unic (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...
MAL-2026-12076 Malicious code in tinkoff-cache-path (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...
MAL-2026-12074 Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce On require of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque...
MAL-2026-12045 Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...
Malicious code in beaver-ui-form-modal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c4d60b5b32e6639dcecb7661afe72c6f5bb9ce486e53a398e81e11932f7379 On require'beaver-ui-form-modal', index.js loads shim.js which downloads a platform-specific binary from string-array-obfuscated Cloudflare Worker...
MAL-2026-12042 Malicious code in platform-ui-island (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...
Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)
The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...
Malicious code in sextant-cli-linux-amd64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...
CLSA-2026-1780620678 TuxCare security update for cross-spawn (1 CVE)
TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 7.0.3-tuxcare.1...
CLSA-2026-1780620667 TuxCare security update for cross-spawn (1 CVE)
TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 6.0.5-tuxcare.1...
CLSA-2026-1776818188 TuxCare security update for cross-spawn (1 CVE)
TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 3.0.1-tuxcare.1...
CLSA-2026-1773793042 TuxCare security update for cross-spawn (1 CVE)
TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 0.2.9-tuxcare.1...
CLSA-2026-1773965919 TuxCare security update for cross-spawn (1 CVE)
TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 5.1.0-tuxcare.1...
