Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

MAL-2026-12496 Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

MAL-2026-12419 Malicious code in pp-react-worldready-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 The tarball contains only package.json and vishu.js; the declared main index.js is absent, so the package has no library functionality...

Malicious code in pp-react-worldready-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 The tarball contains only package.json and vishu.js; the declared main index.js is absent, so the package has no library functionality...

MAL-2026-12498 Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...

Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...

MAL-2026-12326 Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

Malicious code in @offa-uwk/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2 On npm install, the package's postinstall script node index.js collects host identifiers os.hostname, os.userInfo.username, process.cwd and POSTs the...

MAL-2026-12327 Malicious code in @offa-uwk/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2 On npm install, the package's postinstall script node index.js collects host identifiers os.hostname, os.userInfo.username, process.cwd and POSTs the...

Malicious code in uniswap-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with th...

MAL-2026-12490 Malicious code in uniswap-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with th...

CVE-2026-71272

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71272 Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

EUVD-2026-53357

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71272 Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71272 Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71272

CVE-2026-71272 affects Memos’ webhook dispatch function safeDialContext() in internal/webhook/webhook.go. The code resolves the target hostname with net.DefaultResolver.LookupHost(), validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origina...