Malicious Package

Overview backstage-plugin-glean is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

MAL-2025-192944 Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205460

Malicious code in backstage-plugin-glean npm...

EUVD-2025-11351

Malicious code in bioql PyPI...

@apollo/chakra-helpers (>=1.1.0, <=2.2.0), @backstage/plugin-apollo-explorer (>=0.0.0-nightly-20220719025614, <=0.1.17) potentially affected by CVE-2025-59845 via @apollo/explorer (>=0.2.1, <=2.0.2)

@apollo/explorer NPM version =0.2.1, =1.1.0, =0.0.0-nightly-20220719025614, =0.1.17 Source cves: CVE-2025-59845 Source advisory: MEND:CVE-2025-59845...

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2025-55285 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041, <=1.33.0)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-202110122318, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2021101022158, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2021101022158,...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285: Insertion of Sensitive Information into Log File

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

Malicious code in backstage-plugin-kubernetes-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d5e128ce958505a3df2acbdc6b87aaf80b05e6b5a1dec494681ab2ceced6a0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in backstage-plugin-kubernetes-backend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@backstage-community/plugin-rbac-backend (>=5.2.3, <=6.1.1), @janus-idp/backstage-plugin-rbac-backend (>=4.4.2, <=5.2.2) +3 more potentially affected by CVE-2025-32791 via @backstage/plugin-permission-backend (0.5.55)

@backstage/plugin-permission-backend NPM version 0.5.55 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-permission-backend and may be impacted: - @backstage-community/plugin-rbac-backend =5.2.3, =4.4.2, =6.0.1, =0.7.6, =2.0.0, =4.0.0...

@backstage-community/plugin-rbac-backend (>=5.2.3, <=6.1.1), @janus-idp/backstage-plugin-rbac-backend (>=4.4.2, <=5.2.2) +3 more potentially affected by CVE-2025-32791 via @backstage/plugin-permission-backend (0.5.55)

@backstage/plugin-permission-backend NPM version 0.5.55 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-permission-backend and may be impacted: - @backstage-community/plugin-rbac-backend =5.2.3, =4.4.2, =6.0.1, =0.7.6, =2.0.0, =4.0.0...

Server Side Request Forgery (SSRF)

@backstage/plugin-scaffolder-node is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of template functionality in the Backstage Scaffolder plugin, which allows Server-Side Template Injection SSTI to be exploited for Git config injection...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.1.1-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021101022158, <=0.0.0-nightly-20260928023907) +25 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.4.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20230325022054,...

@backstage/plugin-scaffolder-backend (0.0.0-nightly-20241017023338) potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.5.0)

@backstage/plugin-scaffolder-node NPM version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/plugin-scaffolder-backend 0.0.0-nightly-20241017023338 Source cves: CVE-2024-53983...

@backstage/backend-dynamic-feature-service (>=0.4.4-next.0, <=0.5.0-next.3), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338, <=1.27.0-next.3) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.5.0, <=0.5.1-next.3)

@backstage/plugin-scaffolder-node NPM version =0.5.0, =0.4.4-next.0, =0.0.0-nightly-20241017023338, =0.2.2-next.0, =0.3.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.4.3-next.0, =0.1.15-next.0, =0.1.15-next.3 Source cves: CVE-2024-53983...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535) +1 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.6.0)

@backstage/plugin-scaffolder-node NPM version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20241120023536,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.5.1-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=1.28.0-next.0) +11 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.6.0, <=0.6.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.6.0, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.1.16-next.0 Source cves: CVE-2024-53983 Source advisory: OSV:GHSA-QMC2-JPR5-7RG9...