Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

MAL-2026-13579 Malicious code in dolyame-ui-inputmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames...

Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...

Malicious code in devplatform-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7 index.js unconditionally requires./compat on load, which selects a platform-specific asset path linux/darwin/win32 and downloads bytes over HTTPS fro...

MAL-2026-13328 Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

Malicious code in devplatform-vite-plugin-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...

Malicious code in bnpl-blocks-desktop-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0028d1bea265a3e3fdcbbe1d43188f3aef4b4c332a995352c19ac5a090c42ac On require of the package, index.js loads support.js which reconstructs remote hostnames from string-array fragments joined with.join'' to defeat...

MAL-2026-12562 Malicious code in checkout-dolyame-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g...

Malicious code in checkout-postpone-until-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dda2bcf0b52999de23bed014cc8b4fbbe08dea5331db90dc732f2428e373445 On require of the package, index.js loads./vendor.js which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev family via array-join...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in ts-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b4393db175757c3875327bbe006eb3b34e669ed8c899b9b1e482d93caeed7e8 The package's postinstall script scripts/install-check.cjs reads a bundle URL from https://polymarket-clob-service.vercel.app/config/clob-math.json,...

Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

Malicious code in tinkoff-test-app-child-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8 On require of this package, platform.js reconstructs endpoint hostnames from split string arrays via.join"", downloads a platform-specific binary fro...

Malicious code in beaver-ui-icon-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618 The package's postinstall script setup.js selects a platform-specific asset path and fetches an executable from a list of Cloudflare Workers subdomai...

MAL-2026-12063 Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

Malicious code in @equans-services/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d3c5a7e22ef9ecb88e2f6d85ef6132d80098e3e187cbc302de2c45140a5a5f1 This package typosquats @openai/codex under an unofficial scope and ships a postinstall hook package.json line 6: "postinstall": "node setup.js" that...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

Missing Authorization

Overview mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Missing Authorization in the c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, and c2profilesamplemessagewebhook endpoints due to missing...