Security Bulletin: IBM Cognos Analytics is affected by a security vulnerability in Python JSON Logger (CVE-2025-27607)

Summary There is a vulnerability in Python JSON Logger used by IBM Cognos Analytics CVE-2025-27607. This Security Bulletin relates only to the direct usage of third-party components by IBM Cognos Analytics, and not any nested dependencies within the product. Vulnerability Details...

Malicious code in @teamstelemetry/shared-logger (npm)

The package communicates with a domain associated with malicious activity...

Malware in @0xzyo111/frontend-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-6216 Malicious code in bingo-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f96e6e47500342e1cad70444862565ee48be2e2fc9f3d0e7dd92d8e8c662a231 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in bingo-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bingo-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f96e6e47500342e1cad70444862565ee48be2e2fc9f3d0e7dd92d8e8c662a231 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6267 Malicious code in @wptv/logger (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in rc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5638d1bfc139a2ee01491c7afc44cf724fd4b1f7022fbf78bf9430a2cc3f236 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6015 Malicious code in rc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5638d1bfc139a2ee01491c7afc44cf724fd4b1f7022fbf78bf9430a2cc3f236 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in rc-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @company-internal/logger (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d0932de39c3f8c9bcb34c9f241df2d154d4659532cfddb67ddd06e283c38c14 Any computer that has this package installed or running should be considered...

MAL-2025-5941 Malicious code in node-mongodb-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ac7ad5072828933069aa01c5de1ac1780566e205e1866722a012b7fa73c900b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in node-mongodb-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in node-mongodb-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ac7ad5072828933069aa01c5de1ac1780566e205e1866722a012b7fa73c900b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in proc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3789e8e4aa2cd220d264340ceccd11c9e9e8b6d5e35c4ad402303a54500a105c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5949 Malicious code in proc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3789e8e4aa2cd220d264340ceccd11c9e9e8b6d5e35c4ad402303a54500a105c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in proc-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5838 Malicious code in @0xzyo111/frontend-logger (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ea6fe9c933bc0a4ac656882af6f4662783f92087518dbbb253c351f60d44b63 Any computer that has this package installed or running should be considered...

Malicious code in @0xzyo111/frontend-logger (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ea6fe9c933bc0a4ac656882af6f4662783f92087518dbbb253c351f60d44b63 Any computer that has this package installed or running should be considered...

Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log. Credentials Binding Plugin 687.689.v1af775332fc9 rethrows exceptions that contain credentials,...