Malicious code in symphony-hierarchical-confusion-matrix (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6956 Malicious code in snapchat-snapnet (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in dpais-chat-template-pwa (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d39545ec9be8c0beabaaf1f508b0f468a884898b3fb8b8ae6d73b5cb62c54fc The OpenSSF Package Analysis project identified...

MAL-2025-6923 Malicious code in dpais-chat-template-pwa (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d39545ec9be8c0beabaaf1f508b0f468a884898b3fb8b8ae6d73b5cb62c54fc The OpenSSF Package Analysis project identified...

CVE-2025-55010

Kanboard before 1.2.47 is affected by an unsafe deserialization in ProjectEventActvityFormatter that lets an admin modify event["data"] in project_activities to instantiate arbitrary PHP objects, enabling a gadget to write a web shell in /plugins and achieve remote code execution. The issue has b...

CVE-2025-55010

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event"data" field in the...

MAL-2025-6827 Malicious code in mda-localise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 613478d63b9c28c110cb883d28d216af5ac0cc3af224415eafe463a905b391c3 The OpenSSF Package Analysis project identified 'mda-localise' @ 0.0.2-placeholder npm as malicious. It is considered malicious because: - The...

MAL-2025-6826 Malicious code in microsoft-bonsai-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f75eaf29b0dbada65bcac01f3d2789298d785098ab86d180232abf37a1e16070 The OpenSSF Package Analysis project identified 'microsoft-bonsai-api' @ 9.9.9 npm as malicious. It is considered malicious because: - The packa...

AVEVA PI Integrator

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, or upload and execute files. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

Malicious code in tiktok-internal (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6860 Malicious code in tiktok-internal (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in mgtyler (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in gridlock-web (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6840 Malicious code in gridlock-web (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in zylker-eclassifieds-ui (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in localeslice (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in zstd-jni (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6861 Malicious code in zstd-jni (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in exoscale (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in yandex-money-bank-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0e328869c4f8ab6a67a9978769746d5f2112baf3c92882879c8da485d824adc1 The OpenSSF Package Analysis project identified 'yandex-money-bank-utils' @ 8.8.9 npm as malicious. It is considered malicious because: - The...