MAL-2026-13556 Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

Malicious code in dolyame-ui-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1110e4e32da50573666c0e5f281db639994fad22ed178e2039b9689cc350c284 The package advertises itself as a zero-dependency React calendar component library, but on require of index.js it loads shim.js, which selects a...

Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

CVE-2022-2103

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories...

CVE-2015-0912

EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors...

CVE-2015-0912: Undefined Security Weakness

EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors...

PT-2015-4963

Name of the Vulnerable Software and Affected Versions EasyCTF versions prior to 1.4 Description The issue allows remote authenticated users to write executable content to files. Recommendations For versions prior to 1.4, update to version 1.4 or later to resolve the issue...