Malicious code in google-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a306188997a3decdf3eb0566e9ec1b3f81c5b1e0b4269eff69342744a9bad64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fb_helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd02d94679b40d95c81b651a29666a45452deabc83d8e33032104032eef13261 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-7704-4: Linux kernel (NVIDIA) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - Arm Firmware Framework for ARMv8-AFFA; - Multiple devices driver; - Media drivers; - Network...

Malicious code in tanstack-virtual-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b38d98c47aceac75b944aff9d0df30a563d89aaa076329820aa58b119e010448 The OpenSSF Package Analysis project identified 'tanstack-virtual-cor...

MAL-2025-41378 Malicious code in cwl_shared (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41263 Malicious code in sdp-transform-parser (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d6f0bf5deb53b6f1424914462ad86d16738a1118a744d709e3e37abaf8907134 The OpenSSF Package Analysis project identified 'sdp-transform-parser...

MAL-2025-41355 Malicious code in @navify-platform/env (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in sdp-transform-writer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5a7fe67cbf547a37aaa2286e629788d404dbcc306a63bd6edbd4101513e27138 The OpenSSF Package Analysis project identified 'sdp-transform-writer...

Malicious code in @stackgl/gl-conformance (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6402e01df0460d9b2d3778bed73dc61d60fc700196a3bb56a2e91768227f3391 The OpenSSF Package Analysis project identified...

Malicious code in @wp-feature-api/client-features (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Comprehensive MCP Security Checklist: Protecting Your AI-Powered Infrastructure

With innovation comes risk. As organizations race to build AI-first infrastructure, security is struggling to keep pace. Multi-Agentic Systems – those built on Large Language Models LLMs and Multi-Component Protocols MCP - bring immense potential, but also novel vulnerabilities that traditional...

MAL-2025-41258 Malicious code in @bitkub-next-frontend-v2/app-bitkub-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c961401f308dd3c2e7d4639158b0b6c5cf92dbdfcafb06789988dc4824107960 The OpenSSF Package Analysis project identified '@bitkub-next-frontend-v2/app-bitkub-next' @ 1.13.0 npm as malicious. It is considered malicious...

CVE-2025-7390

CVE-2025-7390 describes a bypass of the client certificate trust check in an opc.https server when the endpoint is configured to allow only secure communication. Connected sources indicate affected software/product context primarily around OPC.https servers (e.g., Softing edgeConnector) and Red H...

CVE-2025-7390 Bypass the client certificate trust check of an opc.https server while only secure communication is allowed

A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication...

Malicious code in amp-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dacbeb50af065a576ade73d084e6ac504cb061d33ebdb8fe8d72839b926e9d59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-34191 · Unknown · Opc.Https Server

Name of the Vulnerable Software and Affected Versions: opc.https server affected versions not specified Description: A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication. Recommendations: ...

PT-2025-34277 · Infinitt · Infinitt Pacs System Manager

Name of the Vulnerable Software and Affected Versions: INFINITT PACS System Manager affected versions not specified Description: The INFINITT PACS System Manager allows unauthorized users to gain access without proper authorization, potentially leading to unauthorized access to system resources...

MAL-2025-41254 Malicious code in orion-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d017f02da39bfb33285066e5d65476f32d57195efe73652d4659863fe7b0367c The OpenSSF Package Analysis project identified 'orion-ui' @ 9.2.3 npm as malicious. It is considered malicious because: - The package...

Malicious code in @navify-platform/idle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d4c05f7983c6a597941a36c8177f63342feee29acb5d3922471e2fa25da4f159 The OpenSSF Package Analysis project identified '@navify-platform/idle' @ 2.3.0 npm as malicious. It is considered malicious because: - The...

CVE-2025-33100

IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...