MAL-2025-190785 Malicious code in token.js-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c0ea628a23a78a7ef88dc4301ffbaf6515d00c92b331d0dfe518b6156d6cf01 The package token.js-fork was found to contain malicious code. Source: ghsa-malware c175fb9f3c6376f85f6e9b597aeaa381892983e4348984c54354174cca12f8a2...

MAL-2025-190750 Malicious code in @posthog/piscina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebd3d94d864b267499cd7c7897fa7fc4af2c420f3aa6bd152a0b22feae86418b The package @posthog/piscina was found to contain malicious code. Source: ghsa-malware 731794a5898b7ca6049626b91dad59ed65293d59335397c1989a1b45a498cb...

MAL-2025-190740 Malicious code in @ensdomains/unicode-confusables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f25465205590fbceb2bb8ae1db02fd1e80f8d085af135427cd757a3b08a1da6 The package @ensdomains/unicode-confusables was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190674 Malicious code in @posthog/rrweb-snapshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e09f740a4b99a55a685452aa412d77942e67c0de95136282343012196ed7bf41 The package @posthog/rrweb-snapshot was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190653 Malicious code in @asyncapi/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b13eec1644f2d38922b7e61732a64ae6ee0d71810232ff15c95a3290de465d The package @asyncapi/cli was found to contain malicious code. Source: ghsa-malware 99e5bdb2a7d429f7e01403c432963826b244c3bed02a5a877ace1307b5fee3ad...

MAL-2025-190644 Malicious code in @posthog/ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a9a022b20b3025cb0846139ab6f2a1308025ed8ee902db18aacbfa95c6ea7e6 The package @posthog/ai was found to contain malicious code. Source: ghsa-malware 1e6a08419969270cca059f804bb3ec25aa0427f00ef555a9409c12d50921a83c An...

MAL-2025-190803 Malicious code in @ensdomains/cypress-metamask (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19427e64315a085f7001dff6a896730aa4cce33cf679f6a2da0a8bc61e96fb58 The package @ensdomains/cypress-metamask was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190823 Malicious code in @quick-start-soft/quick-markdown-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebaec604b88bfa99689645f0ecb3061111aa393606337785c71c2755493864f1 The package @quick-start-soft/quick-markdown-image was found to contain malicious code. Source: ghsa-malware...

Malicious code in ginfuru.better-nunjucks (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c1f105a5bf6daf41b694f7cc339589ac86e57964dd2f761bc04b8ea20fe70ae8 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

Malicious code in ellacrity.recoil (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c10eec28bf8da96caa61583697ae4e44102b7a4f1b84e361e0f609be824a79c6 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

Malicious code in l-igh-t.vscode-theme-seti-folder (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security dc07b5a9c4c6f86929db6d62c15f2c2a9c52912263950282c709e0b68387f54b This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

MAL-2025-191163 Malicious code in jeronimoekerdt.color-picker-universal (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1b0ef4a151e758eadda67d487723883b42f68292fd4dc8019068838e08faa8 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

MAL-2025-191169 Malicious code in srcery-colors.srcery-colors (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 2249e8ad553f2a774e7f7e3418d19c033832fcdd1253c29e8bdb92427cb55644 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

EUVD-2025-198041

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

CVE-2025-64709

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

Fake NPM Package With 206K Downloads Targeted GitHub for Credentials (UPDATED)

Veracode Threat Research exposed a targeted typosquatting attack on npm, where the malicious package @acitons/artifact stole GitHub tokens. Learn how this supply chain failure threatened the GitHub organisation's code...

Server-Side Request Forgery (SSRF)

cors-anywhere is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to instances being configured as open proxies that forward attacker-controlled target URLs, methods, and headers without restriction, which allows an attacker to induce requests to internal-only endpoints...