MAL-2026-13554 Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in dolyame-ui-tableinline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8 On require'dolyame-ui-tableinline', index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors...

MAL-2026-13541 Malicious code in delivery-ci-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203 On require'delivery-ci-documentation', index.js loads init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames ...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

MAL-2026-13579 Malicious code in dolyame-ui-inputmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames...

MAL-2026-13551 Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

MAL-2026-13567 Malicious code in dolyame-ui-draghoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955 On require, index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled a...

Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...

MAL-2026-13501 Malicious code in delivery-ci-jira-rnd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9178cec9a952384e307589c3d50840761b3c260ced53213ec8a02f85f629bfd9 On require of the package, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary over HTTPS from Cloudflare...

Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...

Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

EulerOS 2.0 SP13 : golang (EulerOS-SA-2026-2967)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 If a trusted template...

MAL-2026-13379 Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of...

Malicious code in bigops-insite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe91d01b6f87752714ea87b8c79ecdda9497faf4a99709118330640cfaf46a2 On require'bigops-insite', index.js top-level loads./setup.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomain...

Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

Malicious code in bigops-product-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 173f02a73c0c5d6ee6ac7bb757fa64aef91178cfb38c4772d30260c9a7ea4bc1 index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined...

Malicious code in bigops-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573 On require of bigops-products, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

MAL-2026-13236 Malicious code in bigops-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573 On require of bigops-products, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...