VulnCheck KEV: CVE-2025-3935

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised...

Chinese APT41 Exploits Google Calendar for Malware Command-and-Control Operations

Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar for command-and-control C2. The tech giant, which discovered the activity in late October 2024, said the malware was hosted on a compromise...

MAL-2025-4590 Malicious code in rest-icon-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1df42e0b9f4ff541c485fd5c4bb6ebabd85ce2a7aec08ffd4a6234650332ac9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in env-process

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in ethereum-smart-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e10c205ca79402ee59b57b5e2a0475562ba75988af429715c808ad690e6fa49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pancakeswap-oracle-prediction (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3439b65dc3de1c6c43d4ec5ae0e3db4a1fe713e0606f8dc3037ad22dd5741467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in env-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 105ae811c2409aa9875948339815f7f362e64e01e0c82342286fba8de426878f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pancake_uniswap_validators_utils_snipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 791d7ac8f5692ffcb4db92ed0986a9f6c422640fbbe19c1522dbbc0f813aaeb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4589 Malicious code in pancakeswap-oracle-prediction (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3439b65dc3de1c6c43d4ec5ae0e3db4a1fe713e0606f8dc3037ad22dd5741467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4585 Malicious code in internal-lib-razor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0887160400effb60b7905dc584aa2b213c2c74f7696f2c61b798e64d94ef1fec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4527 Malicious code in escapes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a2e963bd0edf0ef49a74d25da006b197e5782c95ff0ea260b5dd72282ba18e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4528 Malicious code in gitdependencyresource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83fef2647750041b69c08748c2113e2bacb9b4cb630d247951daa865f4ef7743 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ledger-transport

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in midd-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dd0235b84c32b991facdc8454fcad039a9ad0d52cdc8f5d4a6c3504657c7fa6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-jsconfig-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa2206f03805567e12ada7cbae343d47492532958d8f685e73562fee9972b3b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in midd-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4534 Malicious code in vite-jsconfig-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa2206f03805567e12ada7cbae343d47492532958d8f685e73562fee9972b3b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4532 Malicious code in midd-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dd0235b84c32b991facdc8454fcad039a9ad0d52cdc8f5d4a6c3504657c7fa6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mirror-chat-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05a80d5c1613fb9a0db9f6d2b95f12da296ef2ac3f58be607c601a87c73d840e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Employees Searching Payroll Portals on Google Tricked Into Sending Paychecks to Hackers

Threat hunters have exposed a novel campaign that makes use of search engine optimization SEO poisoning techniques to target employee mobile devices and facilitate payroll fraud. The activity, first detected by ReliaQuest in May 2025 targeting an unnamed customer in the manufacturing sector, is...