MAL-2026-12534 Malicious code in cardsmobile-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2 On require of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated...

Cross-site Request Forgery (CSRF)

Overview @theia/filesystem is a Theia - FileSystem Extension Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the NodeFileUploadService handler in the filesystem backend code. An attacker can overwrite any filesystem path the backend process can write by...

Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

MAL-2026-12568 Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224 [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js...

MAL-2026-12592 Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

MAL-2026-12588 Malicious code in checkout-promocode-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d75e7966f60937203bdc9f6ee1a90e58fbf046f76ec5aa0b4d68018fce4f87 On require, index.js loads ext.js which selects a per-OS payload path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts...

MAL-2026-12613 Malicious code in claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g...

Malicious code in claims-page-maker-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b337b617f3692fffb0d54a13924ae322ed7e2976c00a61f16c16877aa8c086e5 On require of claims-page-maker-types, index.js loads adapter.js which runs at module load. adapter.js selects a platform-specific asset, fetches an...

MAL-2026-12639 Malicious code in claims-policy-details-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2500b36f91161fd5530acaf1ddc9c5af050b9d874dae9924f686f45f2dbe721 On require of the package, index.js loads loader.js which downloads a platform-specific binary from string-split-obfuscated hosts...

Malicious code in claims-use-visual-viewport-resizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb On require, index.js loads helpers.js which auto-invokes start. The code selects a platform-specific asset, fetches an opaque binary over HTTPS from...

MAL-2026-12683 Malicious code in delivery-ci-tech-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b On require of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays...

MAL-2026-12688 Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12699 Malicious code in devplatform-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626164264796294f1cb4322c03454ff5d9c50f7f0edb7534bfb6a5843d08079d On require of devplatform-cli, index.js loads adapter.js which assembles Cloudflare Workers hostnames from string-split fragments e.g...

MAL-2026-12707 Malicious code in devplatform-create-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464 [email protected] ships an index.js main entry that silently requires bridge.js, which on load assembles Cloudflare Workers hostnames...

MAL-2026-12717 Malicious code in devplatform-jscodeshift-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in devplatform-nx-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf The package presents itself as an Nx stylelint helper but its main entry requires platform.js, which on load downloads a platform-specific executable...

MAL-2026-12741 Malicious code in devplatform-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation...

Malicious code in devplatform-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific...