MAL-2026-13371 Malicious code in multi-acct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395e9271172eea5db15a1090043ee564ad6b8564fb9e267faff883ac3c6af125 [email protected] is a near-empty wrapper index.js is a two-line stub returning name/version literals; author is the generic 'Package Registry' and...

Malicious code in multi-acct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395e9271172eea5db15a1090043ee564ad6b8564fb9e267faff883ac3c6af125 [email protected] is a near-empty wrapper index.js is a two-line stub returning name/version literals; author is the generic 'Package Registry' and...

MAL-2026-13180 Malicious code in dolyame-ui-react-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33 On require, index.js loads helpers.js which runs setup at module load. The setup routine reconstructs mirror hostnames at runtime by joining split...

Malicious code in dolyame-ui-react-dom-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlle...

MAL-2026-13178 Malicious code in dolyame-ui-react-dom-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlle...

Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

MAL-2026-13098 Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-12550 Malicious code in checkout-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b244ec0b7c63b76c59ceef313391742ea858b300088653f5da701db9ca7611 On require, helpers.js reassembles hostnames via array split-and-join to hide the destinations oob-worker.cf.workers.dev and .dl.wel1.ru subdomains...

MAL-2026-12646 Malicious code in claims-use-base-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f191811e6841cbfe4cc2c9621f7876290b92efc2bdc78e9c4f6c4cca7933c0f [email protected] is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads shim.js which selects a...

MAL-2026-12657 Malicious code in cobrowsing-redis-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6 index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split...

MAL-2026-12405 Malicious code in opencode-engos-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274 On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos---baseline-musl, resolves each to the...

MAL-2026-12131 Malicious code in accounts-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7 On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by...

Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

EUVD-2026-53209

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because...

CVE-2026-71212 xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase...

CVE-2026-71212

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because...

CVE-2026-71212

xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...

EUVD-2026-53195

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a pathworkdir, p helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because...