CVE-2023-53940

CVE-2023-53940 affects Codigo Markdown Editor 1.0.1 (Electron). The vulnerability arises from handling of markdown files where an embedded video source with an onerror event can trigger arbitrary shell commands via Node.js child_process, enabling code execution when the file is opened. Public ind...

CVE-2025-66219

CVE-2025-66219 affects the willitmerge CLI, specifically versions 0.2.1 and earlier. The root cause is the use of an insecure child-process execution API (exec) that concatenates user-provided input (from command-line flags or repository-controlled data) into shell commands, enabling command inje...

HSEC-2025-0006 Private key leak via inherited file descriptor

Private key leak via inherited file descriptor The X.509 key reading function readKeyFile opened a file descriptor to the private key without setting the close-on-exec flag. If a child process is execed at the same time, it would inherit that file descriptor and could read the private key materia...

EUVD-2025-180107

Malicious code in bellatrix-quantum-inquirer-child-process npm...

EUVD-2025-176986

Malicious code in proteomics-electron-triton-child-process npm...

Malicious code in xanthus-child-process-radiant-biotechnology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0772cba129a84f6a60d24186646d0488d9fea195f97e08ef3a181221632a17c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176414

Malicious code in server-child-process-cosmicray-extremophile npm...

EUVD-2025-179739

Malicious code in child-process-concurrently-chakra-ui-node-sass npm...

EUVD-2025-175523

Malicious code in xanthus-child-process-radiant-biotechnology npm...

Malicious code in hermes-child-process-apex-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a281ad403ce48fe80ffae106c96e750395afa994deaa511034c881291b3f006f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179264

Malicious code in dotenv-parse-variables-init-child-process-genomics npm...

MAL-2025-186147 Malicious code in child-process-xenon-avior-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9f4f073cd819427d81027c4347194f2093797d2605e1e90dbf83b1979f7d03c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xo-helios-child-process-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6abf116ef5bd6a77aedf9bcc2b5428a4945e26fbf2e8c0d79a0fccebb457771 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179738

Malicious code in child-process-eridanus-cypress-zephyr npm...

EUVD-2025-179735

Malicious code in child-process-xenon-avior-perseus npm...

EUVD-2025-179736

Malicious code in child-process-stratigraphy-subduction-node-sass npm...

EUVD-2025-176882

Malicious code in quantum-child-process-vulcan-sagitta npm...

EUVD-2025-180518

Malicious code in acamar-child-process-oauth-nodejs npm...

EUVD-2025-175471

Malicious code in xo-helios-child-process-pm2 npm...

MAL-2025-186142 Malicious code in child-process-charon-mui-on (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee5e948049c8cfee3a492e90195667a71b6c916914451d1fdfaa8ec56a48d7c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...