CVE-2025-59162 [email protected] contains malware after npm account takeover

color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added...

color-convert 安全漏洞

color-convert is a color conversion function in JavaScript by Josh Junon Personal Developer. A security vulnerability exists in color-convert version 3.1.1, which stems from malicious code implanted after a phishing attack on an account, and could lead to the redirection of cryptocurrency...

CVE-2025-59162: Embedded Malicious Code

color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added...

Malicious Package

Overview @js-to-lua/convert is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in @js-to-lua/convert

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in color-convert (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ee3370ed9cf22bf89fbf40c954408a6ddcd17fbd38750027a2b7fab6034bce Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-46971 Malicious code in color-convert (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ee3370ed9cf22bf89fbf40c954408a6ddcd17fbd38750027a2b7fab6034bce Any computer that has this package installed or running should be considered fully compromised. All...

Duplicate Advisory: Malware in color-convert

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pxx3-g568-hxr4. This link is maintained to preserve external references. Original Description Any computer that has this package installed or running should be considered affected by a browser-based interceptor...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code activates a hook whenever a Web3 wallet is present...

PT-2025-37747

Name of the Vulnerable Software and Affected Versions: color-convert versions prior to 3.1.2 Description: The npm package color-convert was compromised through a phishing attack on the publishing account. A malicious version 3.1.1 was published containing a payload designed to redirect...

btrfs: exit after state insertion failure at btrfs_convert_extent_bit()

...

CVE-2025-36906

A heap buffer overflow vulnerability exists in the ConvertReductionOp function within darwinn_mlir_converter_aidl.cc . This flaw allows for an out-of-bounds write, which could lead to a local elevation of privilege (EoP) without requiring additional execution privileges or user interaction. This ...

CVE-2025-36906

In ConvertReductionOp of darwinnmlirconverteraidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Linux Distros Unpatched Vulnerability : CVE-2018-16982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Chinese Convert OpenCC 1.0.5 allows attackers to cause a denial of service segmentation fault because BinaryDict::NewFromFile in BinaryDict.cpp may have...

PUB-A-289810779

In ConvertReductionOp of darwinnmlirconverteraidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-30057

In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system call in the ConvertToPDF function...

Linux Distros Unpatched Vulnerability : CVE-2020-23109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow vulnerability in function convertcolorspace in heifcolorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and...

Linux Distros Unpatched Vulnerability : CVE-2025-5001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function...

Linux Distros Unpatched Vulnerability : CVE-2021-3574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks. CVE-2021-3574 Note that...

The vulnerability of the btrfs_convert_extent_bit() function in the btrfs component of the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the btrfsconvertextentbit function in the btrfs component of the Linux kernel lies in the handling of zero pointers. Exploiting this vulnerability could allow an attacker to trigger a system failure...