MAL-2025-5022 Malicious code in @jito-lab/provider (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5024 Malicious code in asf-core (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in cycle-a (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in 0vulns-dependency-confusion-poc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d282025fb2ec1b4012e3b979cec1f66520e643fcadfd2864e54989de50dd00d The package.json preinstall script runs wget against an attacker-controlle...

GHSA-PRWH-7838-XF82

creationtimestamp| type| source ---|---|--- 2025-06-12 15:33:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18174 2025-06-13 16:12:22+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114676933739618253...

MAL-2025-4932 Malicious code in uniswap-v4-scratchpad-poc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01754c5d133c195a4c109504b5db8355893e90a308a2317d421d8f2d034cad23 Any computer that has this package installed or running should be considered...

Malicious code in volehai-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 695b1f1647ff88855017c178d47ab04527b14c3817e9b4ed343c1220cc7b18df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @dm3-org/dm3-lib-crypto (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in mtrtestinglalalal (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5035 Malicious code in izat (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d4b31edff23083b4856a85c28082ba87105b963e68ddc7abd96a799d5594b09 Any computer that has this package installed or running should be considered...

MAL-2025-5032 Malicious code in error-ux-components (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 476bc83dcd99575742060ce7a3f129b15a4da89c0605ae7b4eb57e4cef54bf8b Any computer that has this package installed or running should be considered...

CVE-2024-41504

Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting XSS. In the "Oportunidades" opportunities section of the application when creating or editing an "Atividade" activity, the form field "Descrico" allows injection of JavaScript...

MAL-2025-4793 Malicious code in lichess-db (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 475d752d815f7e78b4625da2eea3b8f39eab9a81a1fd93dd56d2d3aab31c379f Any computer that has this package installed or running should be considered...

CERTFR-2025-ACT-024

creationtimestamp| type| source ---|---|--- 2025-06-10 13:38:46+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lrazcguxpr27 2025-06-10 13:38:48+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114659342788625601...

Malicious code in react-server-dom-fb (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3de60ce6ee796258f00f8278b01f38d42a0db62601e38791bd2ab9a1b20cbdeb Any computer that has this package installed or running should be considered...

Over 70 Organizations Across Multiple Sectors Targeted by China-Linked Cyber Espionage Group

The reconnaissance activity targeting American cybersecurity company SentinelOne was part of a broader set of partially-related intrusions into several targets between July 2024 and March 2025. "The victimology includes a South Asian government entity, a European media organization, and more than...

MAL-2025-4753 Malicious code in my-headline (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ceef507a7783e91b9901900d55040847c4c3866b6da30892e317299f295b3da Any computer that has this package installed or running should be considered...

CVE-2025-30957

Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through = 1.1.2...

MAL-2025-4718 Malicious code in pay-reconciler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2ebf90fee62eaa35da095882fe22a5cc2163801652334e5441101fb02a336b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ml-payment (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b15f383166aad3ae73303a775a513a1ea7c14f763d168d6dc1eb971abf0cd0e Any computer that has this package installed or running should be considered...