Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

JLSEC-2026-107 Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equivalent to --allow-env, and writing /proc/self/mem may provide access equivalent t...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...