Malicious code in formatjs-internal-intl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93108c8da3931417e2009ddb17d45ffd86062e129a805a7ff62f3361780fd2d6 The OpenSSF Package Analysis project identified 'formatjs-internal-intl' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-5743 Malicious code in actions-experiment (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3571367d4274d4ca5d5c2cd7b400c40b4d656c2c58fb0746e8372cb24910c5b The OpenSSF Package Analysis project identified 'actions-experiment' ...

MAL-2025-5807 Malicious code in dashboard-demo (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d421eea33f3a5072db15cff1f0c190af64dc4e7d8963bb2eb8a32d6ac855945d Any computer that has this package installed or running should be considered...

PT-2025-28944 · Undefined · Undefined

@qualys re: https://t.co/pNbBaege7E You use CVE-2022-24458 and CVE-2022-24548, should be 24548 only right?...

MAL-2025-5818 Malicious code in playwright-e2e-testing (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1947219a5f6bf4374f28676075008bd3dc532f9ffde90b285e73fcd418a198c4 Any computer that has this package installed or running should be considered...

SUSE CVE-2025-38212

In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, 0 0: https://lore.kernel.org/all/[email protected]/ idrforeach is protected by rwsem, but thi...

MAL-2025-5652 Malicious code in ru.rustore.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00da899e7e957138cf68d9b59fa02210d5b3cae226639924b65810cfa7c4ce78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5651 Malicious code in @laredoute/design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e56fdae15fb0b525a4212e71ff9dd4ec7cd0e3f4076552ec379c49c8f4a4e899 The OpenSSF Package Analysis project identified '@laredoute/design-tokens' @ 0.1.55 npm as malicious. It is considered malicious because: - The...

MAL-2025-5801 Malicious code in @rupahealth/design (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0616aa94e7e7f933fb1f912840b3ec202980dde2d75d689d36e2d3cee1a22cec Any computer that has this package installed or running should be considered...

MAL-2025-5648 Malicious code in jenkins-for-jira-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4eb6219412d635487c17cb5e33f5085c2fced525cf0f510f8df2728d299f028f Any computer that has this package installed or running should be considered...

Malicious code in mttdocs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware beaa5b8141bfc9ba6d1eaaa989a534c5cfc5c7b84c82e6c3ed0c38d5112efbe4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5766 Malicious code in bazel-kotlin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e72bd563ced782c2a9514e4b3c995c7232eb432728faca3a7dcc9ec8f64ad2 Any computer that has this package installed or running should be considered...

MAL-2025-5633 Malicious code in calling-an-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e35c18add1f54ce7dfa19f1c98983a68e10d2796262bd72bf8233fe7e6276aae Any computer that has this package installed or running should be considered...

CVE-2025-27457

All communication between the VNC server and clients is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data...

CVE-2025-27458

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...

Malicious code in iwf-typescript-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35758863836741b6af571432b4354ae16c72c1fcc720cae04dfb0c6506249e40 Any computer that has this package installed or running should be considered...

MAL-2025-5630 Malicious code in iwf-typescript-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35758863836741b6af571432b4354ae16c72c1fcc720cae04dfb0c6506249e40 Any computer that has this package installed or running should be considered...

Malicious code in cmc-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a5a8b47acbc96bb3300d8a151d3e815bd1ed23b9ffa960bea03f4a2d2508ae4 Any computer that has this package installed or running should be considered...

Malicious code in consgraphqlnodeserv (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1884eb1cec539175697a599d5efe57c8627b48df2ec8f1e92eff097a796510da Any computer that has this package installed or running should be considered...

Malicious code in @super-alpha/api (npm)

The package communicates with a domain associated with malicious activity...