Malicious code in @nf-addons/am-global-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.usernam...

Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That file resolves the os and dns core modules indirectly through...

Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

Malicious code in @user-services/web-components (npm)

Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the module. The probe in probe/impl.js reads os.userInfo.username,...

MAL-2026-16379 Malicious code in @user-services/web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the modul...

CVE-2026-32705

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

CVE-2026-32705

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

CVE-2026-32705: Stack-based Buffer Overflow

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

PX4-Autopilot security vulnerabilities

PX4-Autopilot is an open-source drone autopilot system developed by PX4. Versions of PX4-Autopilot prior to 1.17.0-rc2 contained security vulnerabilities. These vulnerabilities stemmed from the BST telemetry probe’s use of a length-based string terminator without proper boundary checks, which cou...

CVE-2026-32705

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

EUVD-2026-12148

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

CVE-2026-32705 PX4 autopilot BST Device Name Length Can Overflow Driver Buffer

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

CVE-2026-32705 PX4 autopilot BST Device Name Length Can Overflow Driver Buffer

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...