Malicious code in mapbox-gl-js-toys (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in newrelic-helper-lib (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6842 Malicious code in isotopet4s-layout (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89341dbe7c72a6b4924313c2697d976b5570b3c9056de1b6ebf35ad41337387d The OpenSSF Package Analysis project identified 'isotopet4s-layout' @...

GHSA-6JCC-XGCR-Q3H4 @fedify/fedify has Improper Authentication and Incorrect Authorization

Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor...

Malicious code in react-native-kraken-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6dd9f629078cdad7b927b9f85f1d8b3a5d381a6009e08c65eafca6272b20cbf2 The OpenSSF Package Analysis project identified 'react-native-kraken-oauth' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

PT-2025-32420

Name of the Vulnerable Software and Affected Versions Fedify versions prior to 1.3.20 Fedify versions 1.4.0-dev.585 through 1.4.12 Fedify versions 1.5.0-dev.636 through 1.5.4 Fedify versions 1.6.0-dev.754 through 1.6.7 Fedify versions 1.7.0-pr.251.885 through 1.7.8 Fedify versions 1.8.0-dev.909...

MAL-2025-6801 Malicious code in sendbird-notifications-extension-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db0ee25cfff1ec99d94cc0e5866df17eda725c53a92c98ce3057df8f5f23c9cc The OpenSSF Package Analysis project identified 'sendbird-notifications-extension-example' @ 1019.0.1 npm as malicious. It is considered malicio...

Malicious code in epiro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7122f2d54ca4daac05c1acb2f7b2606264eb310be4585dc75a345a1d38ec52ab The OpenSSF Package Analysis project identified 'epiro' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates...

Malicious code in criteo-video-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a71052dd6a243d5cbf33f701f287777125ed237e9d9b2e750874fea97a0d7618 The OpenSSF Package Analysis project identified 'criteo-video-player' @ 1.0.0 npm as malicious. It is considered malicious because: - The packag...

Malicious code in simple-web-app-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3c77bf97c7fa506294389252c6bdf8c7918abe5aa4b0cb2956217963d11e33a6 The OpenSSF Package Analysis project identified...

Malicious code in adminarmorproject (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6850 Malicious code in nova-state (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6839 Malicious code in gik2-test (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in gik2-test (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-20332

creationtimestamp| type| source ---|---|--- 2025-08-06 16:53:40+00:00| seen| Telegram/q1LWP18PLRKuHXvRFSxbbPe8VakXAgjJxN-XkmDyp9STu0g...

MAL-2025-6837 Malicious code in faulthandler (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in local-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 387d97d2771b4d02eb1e07831089413d12a5433a784594be2b4b701e5b4b960c The OpenSSF Package Analysis project identified 'local-dep' @ 7.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in jcr-hopper (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in thisisthedaventestz (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in thisisthedaventestpoc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...