Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...

Malicious code in devplatform-humanize-network-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197 [email protected] advertises itself as a network-error humanizing utility, but on require its index.js unconditionally loads...

Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

MAL-2026-12734 Malicious code in devplatform-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific...

Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

MAL-2026-12375 Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f On require of the package's main entry, vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under...

Malicious code in tinkoff-statist-browser-typed-client-sme.users.origination.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bfbb507be06c5d117ac6bfdff47a2441c2198b0d5702e4da97f598bc0d880a3 The package's main entry require's loader.js, which at import time downloads a per-platform binary from string-concatenation-obfuscated Cloudflare...

Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...

Malicious code in @array-util/nodepull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcafb3a6336948fd12673cfe88d505e2a036afcfb5e9ee5d4b850cf982753d9b @array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require/import, the IIFE silences process error handlers vi...

Security Bulletin: Security Vulnerabilities in node.js packages affect IBM Voice Gateway

Summary Security Vulnerabilities in node.js packages affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-12816 DESCRIPTION: An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attacke...

UBUNTU-CVE-2025-54798

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4...

GHSA-52F5-9888-HMC6 tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

Summary [email protected] is vulnerable to an Arbitrary temporary file / directory write via symbolic link dir parameter. Details According to the documentation there are some conditions that must be held: // https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1L41-L50 Other breaking changes,...