The npm package mini-hardhat version 1.1.4 contains malicious code that masquerades as a JSON logger but actually spawns a detached child process. This child process fetches and executes remote code from an obfuscated URL, enabling arbitrary code execution within the user's Node.js environment. The malicious behavior is engineered to persist beyond the parent process, making it a remote code execution dropper.
The npm package native-env@1.0.1 is a malicious package masquerading as a zero-dependency dotenv toolkit. On Windows, it executes attacker-controlled code immediately upon being required or run. It uses a JPEG file as a payload carrier to evade static scanners, writes a VBScript to the temp directory, and launches a PowerShell command with an encoded payload. The package is a typosquatting attempt targeting dotenv-family packages.
The npm package dotenv-native (version 1.0.1) is a malicious typosquat of the popular dotenv package family. It executes attacker-controlled code on module load by extracting and decoding a hidden payload from a bundled JPEG file, writing a VBScript file, and launching PowerShell with an encoded command on Windows hosts. The package also includes an obfuscated decode-and-eval remote code execution primitive. Both requiring the package as a dependency or running its CLI triggers the malicious payload.
The npm package fabric-native-loader version 1.0.0 contains malicious code that executes during installation. It steals Minecraft launcher credentials and related tokens from various launcher files and system information, then sends this data to a hardcoded Discord webhook. The package does not provide any legitimate functionality matching its name and solely acts to exfiltrate sensitive user credentials.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d)
On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.
The npm package 'test-agency-assignment' version 1.0.2 contains malicious code that executes automatically on Windows hosts during installation. It uses a postinstall script to run a Visual Basic Script (VBS) that decrypts and loads a PowerShell payload designed for process hollowing, enabling arbitrary code execution. The package masquerades as a benign telemetry tool but functions solely as a dropper for attacker-controlled code.
Nodemailer versions from 5.0.0 up to 10.0.1 have a vulnerability in their process-global DNS cache that causes TLS server name indication (SNI) to be reused incorrectly across SMTP transports. This flaw allows one tenant in a multi-tenant environment to cause another tenant's SMTP transport to use the attacker's TLS server name and certificate, leading to potential SMTP credential disclosure. The issue arises because the DNS cache key is only the host, but the cached value includes the TLS server name, which is overwritten and reused improperly. No official patch was available at the time of this report.
Multer's diskStorage engine has a vulnerability where aborted multipart uploads can leave orphaned files on disk. This occurs in a brief window before the storage engine assigns the file path, allowing unauthenticated attackers to cause denial of service by exhausting disk space. The issue affects versions from 2.2.0 up to but not including 2.4.0. The vulnerability is a partial regression of a previous fix (CVE-2026-5038). No workarounds are available, but upgrading to version 2.4.0 or higher resolves the issue.
Morgan versions prior to 1.12.1 are vulnerable to log injection via unescaped double quotes in quoted log fields. This vulnerability allows an attacker controlling certain request fields to inject double quotes that prematurely close quoted fields in the Apache combined log format, enabling forged log entries. The issue affects the combined, common, default, and any custom formats that quote tokens. A fix is available in version 1.12.1.
A denial of service (DoS) vulnerability exists in the Angular Server-Side Rendering (SSR) package @angular/platform-server due to a flaw in the domino HTML parser. When processing untrusted input containing an incomplete DOCTYPE declaration ending with whitespace before EOF, the parser enters an infinite synchronous loop that consumes 100% CPU and freezes the Node.js server process. This affects applications that bind untrusted user input to [innerHTML] or manipulate DOM on the server. The vulnerability is exploitable remotely without authentication. Workarounds include avoiding direct binding of untrusted input to [innerHTML] or sanitizing input to reject incomplete DOCTYPE strings. A patch is available for affected versions.
The fast-uri library has a vulnerability where it accepts hosts with unbalanced or misplaced brackets in the URI authority without error. This can cause discrepancies between the host parsed by fast-uri and the host resolved by Node.js URL clients, potentially leading to security bypasses in host-based access controls. The issue is fixed in fast-uri versions 2.4.6, 3.1.7, and 4.1.4.
An XSS vulnerability exists in @angular/platform-server during server-side rendering when processing instruction DOM nodes inside fallback raw-content elements like <noscript> are serialized without properly escaping closing tags. This allows an attacker controlling the processing instruction data to break out of the fallback container and execute arbitrary JavaScript in the browser. The vulnerability affects versions before 22.1.4, 21.2.22, and 20.3.30, and also versions up to 19.2.25. Exploitation requires programmatic creation of processing instruction nodes with untrusted input inside fallback elements during SSR. A fix is available in the specified patched versions.
A vulnerability in grpc-node versions prior to 1.13.1 and between 1.14.0 and 1.14.1 causes the RBAC path matcher to perform a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. This can lead to incorrect authorization if one method name prefixes another and they have different access rules. The issue is fixed in versions 1.13.1 and 1.14.1.
The llm-nebula npm package version 1.0.0 contains a malicious preinstall script that executes automatically during installation. This script is heavily obfuscated and runs with the user's privileges, enabling arbitrary filesystem, process, and network operations. The package pretends to be a legitimate LLM SDK but includes a runtime decoder that dynamically resolves Node.js built-in modules and commands, allowing remote code execution at install time.
The ip-address JavaScript library prior to version 10.5.1 contains an incorrect comparison vulnerability in its IPv6 link-local address detection. The Address6 isLinkLocal method only recognizes the fe80::/64 range instead of the full fe80::/10 range, causing inconsistent classification of certain link-local addresses. This inconsistency can allow an attacker-controlled address within the broader fe80::/10 range to bypass trust-boundary checks relying on isLinkLocal, potentially reaching on-link hosts outside intended boundaries. The issue is fixed in version 10.5.1.
A Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address JavaScript library versions 10.2.0 through 10.5.0. The issue arises because the Address6 isPrivate classifier does not recognize the NAT64 local-use range 64:ff9b:1::/48, potentially allowing internal IPv4 destinations encoded through this range to be treated as external. This can lead to bypassing network trust boundaries in applications that rely on isPrivate, isLoopback, and isLinkLocal for trust decisions. The vulnerability is fixed in version 10.5.1.
The npm package simple-date-formatter-new-12@1.0.0 contains malicious code in its postinstall script that executes automatically during installation. This script fetches data from an internal Baidu host and exfiltrates the response to an attacker-controlled server. The package's stated functionality is a simple date formatter, but the embedded network activity is unrelated and indicative of a dependency confusion or typosquatting attack to probe internal network access and leak data.
The nebulaai-sdk npm package version 1.0.0 contains malicious code that executes a hidden Windows executable during installation on Windows systems. This executable is disguised as a legitimate Windows console host binary and establishes a remote command-and-control connection. The package lacks legitimate SDK functionality and solely serves to deploy and run this malicious payload, resulting in arbitrary code execution under the installing user's context.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4)
On every `require('figlet-chalk-render')`, a top-level IIFE queries `https://registry.npmjs.org/figlet-chalk-render/latest` and, if a newer version exists, spawns `npm install figlet-chalk-render@<latest>` with cwd set to `path.join(__dirname, '..', '..')` (the consumer project's root) and stdio ignored. The `https`, `child_process`, and `path` core-module names are loaded via hex-escaped string literals (`'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'`, etc.) rather than plain identifiers, deliberately hiding the sensitive requires backing the auto-update. The behavior is undocumented in the README. Every consumer that imports the module receives whatever the latest published version happens to be at that moment, executed with the installer's npm privileges and lifecycle scripts, giving anyone who later controls this package name a silent code-execution channel into every installer's project tree. The hex-obfuscation of the module names is anti-evasion and rebuts a benign-self-update reading: legitimate insecure-update code does not disguise `require('child_process')`.
The npm package chalk-figlet version 1.2.0 contains malicious code that executes during installation. It runs a postinstall script that downloads a binary named RuntimeBroker.exe from an untrusted HTTP source and executes it on the host system. The package masquerades as a harmless chalk and figlet wrapper but performs unauthorized code execution.