MAL-2026-12179 Malicious code in fb-insurance--boxified-form-vzr-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1527da37d48efd3c216bf62d4f3d167181948006ad5d8e88f2ff9fa40eb0875 On require of the package, index.js loads loader.js which selects a platform-specific endpoint, fetches an executable payload over HTTPS from hardcod...

MAL-2026-12233 Malicious code in tinkoff-boxy-independent-kasko-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc On require of the package, index.js loads bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfuscation and downloads a...

MAL-2026-12264 Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

MAL-2026-12261 Malicious code in tinkoff-statist-browser-typed-client-investaccounting.events.templatepage.mainpage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01843210cccc7d6327d870fbe2f8d53a493aa8d1db525de7473f30f97ea9dcdb On require of the package, index.js loads bridge.js which assembles Cloudflare Workers hostnames by joining split string fragments e.g...

Malicious code in tinkoff-terminal-kit-datetime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ff5d079ddd6e9ef6bd552f3a33ec5d0c87dcad3dce14013cbf28cbaa37a1dc1 The package's main index.js unconditionally requires runtime.js, which on any require/import selects a platform-specific endpoint and downloads an...

Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

MAL-2026-12150 Malicious code in bigops-auth-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542 On require'bigops-auth-cache', index.js loads compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

MAL-2026-12156 Malicious code in bigops-chat-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8d11b7e8abee5caddc5c2f1765fa7f10d40c8cce0ef1cafed55fe31537be94 On require of bigops-chat-transfer, platform.js reconstructs one of three Cloudflare workers.dev hostnames from split string fragments...

MAL-2026-12153 Malicious code in bigops-awesome-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1204820931e9021a079d3347320d6c127f68297ee6b0223b37967f6c2601f78 index.js unconditionally requires./loader on module load. loader.js reconstructs endpoint hostnames from split string arrays evading static matching,...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

Malicious code in bigops-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a2b7c0da202027f856d059a571a04e01fd992845a158dcd01dfcd1bea4000bb The package advertises itself as an eslint helper but, on require of index.js, unconditionally loads helpers.js which fetches an OS-specific executab...

Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...

MAL-2026-12036 Malicious code in bigops-chat-tmsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...

[SECURITY] Fedora 44 Update: perl-5.42.3-525.fc44

Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

MAL-2026-11550 Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Root-My-Galaxy-Payloads

Root My Galaxy Payloads This repository contains the device-s...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...