Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520 The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On...

Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12216 Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12231 Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

Exploit for Improper Input Validation in Microsoft

TryHackMe: Moniker Link — CVE-2024-21413 Walkthrough A full w...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12075 Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

MAL-2026-12074 Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce On require of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque...

PT-2026-68174

Name of the Vulnerable Software and Affected Versions CCleaner versions prior to 7.10.1464 Description A link following issue exists in the Uninstaller component on Windows. A local, low-privileged attacker can escalate privileges to SYSTEM by creating a symlink or junction during the application...

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

MAL-2026-11995 Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

MAL-2026-11542 Malicious code in osinthell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458757b4c185e84321b45bd7fec158459300d68106826e5774df2399818c7916 The package's only exported function, sorgu, invokes 26 sibling modules under public/a/b/.../z/ that carry out an immediate, irreversible destructive...

CVE-2026-18657

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

CVE-2026-18657

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

EUVD-2026-52914

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

CVE-2026-18657

CVE-2026-18657 — Kiro CLI on Windows : An uncontrolled search path element in Kiro CLI before version 2.10.0 may let a remote unauthenticated actor execute arbitrary code by a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local use...

CVE-2026-18657 Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

CVE-2026-18656 Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the...

CVE-2026-18656

Kiro IDE on Windows prior to 1.0.228 is affected by an uncontrolled search path element vulnerability that can let a remote unauthenticated actor execute arbitrary code via a malicious project directory containing an executable, bypassing workspace trust protections when a local user opens the di...

Security Updates for Microsoft Windows Admin Center (July 2026)

The Microsoft Windows Admin Center installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. CVE-2026-56169 - Improper...