GHSA-65FC-CR5F-V7R2 js-toml Prototype Pollution Vulnerability

A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...

js-toml Prototype Pollution Vulnerability

A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...

PT-2025-31886

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.0.2 Description A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This can lead to severe...

CVE-2025-54789: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...

CVE-2025-54789

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...

Malicious code in tensor-nft-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6661 Malicious code in tensor-nft-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6424 Malicious code in intercom-gtm-js (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ethers-js-core (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6416 Malicious code in ethers-js-core (npm)

--- -= Per source details. Do not edit below this line.=-...

Malware in vite-plugin-js-support

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-6345 Malicious code in vite-plugin-js-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623ab60cdb0568726940f6f7f51b62cad9f69bd835cbf4e9a0fcbda0530a307c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-plugin-js-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623ab60cdb0568726940f6f7f51b62cad9f69bd835cbf4e9a0fcbda0530a307c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-4979

A cross-site scripting XSS vulnerability exists in Sitecore Experience Platform XP 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platfor...

zip

This is a robust ZIP decoder with defenses against various types of malicious archive signatures, including dangerous compression ratios, spec deviations, and ambiguous UTF-8 filenames. The decoder is implemented in JavaScript and is designed to be used in a Node.js environment. It provides a ran...

Malicious code in xp-anti-fraud-js-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f4628140ad8ca2bfe8fde97530e932f9f26df49b3841157bc7f8aa50535e77f7 The OpenSSF Package Analysis project identified 'xp-anti-fraud-js-lib...

MAL-2025-6240 Malicious code in xp-anti-fraud-js-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f4628140ad8ca2bfe8fde97530e932f9f26df49b3841157bc7f8aa50535e77f7 The OpenSSF Package Analysis project identified 'xp-anti-fraud-js-lib...

@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +4 more potentially affected by CVE-2025-54558 via @openai/codex (>=0.1.2504211509, <=0.8.0)

@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.23.0, =1.0.0, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2025-54558 Source advisory: MEND:CVE-2025-54558...

MAL-2025-6219 Malicious code in react-international-phone-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55dc391aa3ec3a479f332033f4ed1c9804c98935cd8ec931e830a8f44a9b790f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in react-international-phone-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...