14823 matches found
MAL-2025-48617 Malicious code in cloud-data (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 424f85d34d816976e9e4e9674c41801256f7db680cdc2c3ce4c5363bd81c876a Any computer that has this package installed or running should be considered...
Malicious code in faustjs-org-sitemm2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd5170a7cd8c6057c679a57454447d33c3c699d911bb06b70386d4d67244ef1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Strings in the maze: Finding hidden strengths and gaps in your team
Welcome to this week's edition of the Threat Source newsletter. "The truth about the world, he said, is that anything is possible... For existence has its own order and that no man's mind can compass, that mind itself being but a fact among others." ― Cormac McCarthy, "Blood Meridian" Earlier thi...
Malicious code in lightspark-crypto (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-48750 Malicious code in paysafe-client-proxy (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ca3abf57e822e819e2d6ce06757f3a061020e9f84cde317ba1382e03d945884 Any computer that has this package installed or running should be considered...
Malicious code in internal-links-autocomplete-id (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in purchases-roku (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c429e2a2e9aa0a6cda588f67e61e21c1830f469ed3a4b29f17845326869ba2be Any computer that has this package installed or running should be considered...
MAL-2025-48558 Malicious code in demo-mercadopago-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a777ccccffbf142e34b0081be4681c4ffcb72aa584b99d15bfd58878e6085881 The OpenSSF Package Analysis project identified 'demo-mercadopago-mcp-server' @ 99.0.3 npm as malicious. It is considered malicious because: - T...
CVE-2025-41108
The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station tablet and gaining unauthorised full control of the robot. The absence of encryption and authenticati...
CVE-2025-41108 Improper Authentication vulnerability in Ghost Robotics' Vision 60
The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station tablet and gaining unauthorised full control of the robot. The absence of encryption and authenticati...
MAL-2025-48555 Malicious code in user_oidc (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e28e6e5435f54199a3dca6186e1ad2d2846226bcf0a6792ff09d40b6215ed7af The OpenSSF Package Analysis project identified 'useroidc' @ 8.0.2 np...
MAL-2025-48753 Malicious code in puppeteer-jest (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b344f7f7f48bc61a2216808c72e518be94a33da9dac41acba0de196d228384 Any computer that has this package installed or running should be considered...
MAL-2025-48621 Malicious code in cypress-typescript (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b097d06051e8ef675fa3ea9aa9b85954881d62d81b5e6e4301716fffd4807c9 Any computer that has this package installed or running should be considered...
MAL-2025-48744 Malicious code in node-js-playwright-browserstack (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1641207c93032c94f176032bea4a9fc81eecc63bf9340ebc483585378afdb939 Any computer that has this package installed or running should be considered...
Malicious code in node-js-playwright-browserstack (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1641207c93032c94f176032bea4a9fc81eecc63bf9340ebc483585378afdb939 Any computer that has this package installed or running should be considered...
Malicious code in test-all2 (npm)
The package communicates with a domain associated with malicious activity...
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability
Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets...
MAL-2025-48556 Malicious code in qwant-search-extension (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b62fa18764e78b78ad37bea56c978df2cba57aa015e3b3eb13b0fc74e05678b1 The OpenSSF Package Analysis project identified...