MAL-2025-47343 Malicious code in react-jsonschema-form-extras (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a348a6e6add3a526378c82c718c9589edc804b3a2c90e291c0abc25798ba1047 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47347 Malicious code in rxnt-kue (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ec749849185c3ae0212a13b39a44ff783ea47aa560116e7af14df511632585e Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in ts-gaussian (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28976f40d9c1e8c05d8a074ce4984cedef949d2d116e5131b5db71e55cd43695 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ngx-toastr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1774663df406fad902dc8413cbf9ac9df437d53215cfb394dd10122b768ebc9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ctrl/deluge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d92c8c0ce4fcd72693ec79d2f5d112099c3e5d23e214a06327498cfa5b655fc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47142 Malicious code in @ctrl/torrent-file (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff09406779243d2fc9bc760936ed5d719341a950dcd013607c74fb31c9b437f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47158 Malicious code in @nativescript-community/ui-material-core-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e43f7ab3687acb4775d0c018af848b2f959bafdfaa3556f42b4c67778254450 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47147 Malicious code in @nativescript-community/gesturehandler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c25d691508dd5a2da24859854f28998b2bc0456d3e73edfc5aeeb61c2fd7d1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47150 Malicious code in @nativescript-community/sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12fdec6c515865f33dafbfd89c6a2e810138eab46fe92d29955d74a13e37567f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47169 Malicious code in @nstudio/xplat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 428f67f5c50b5dde563748444f509f1f52d4c606edea886a1906b387cf40198a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47165 Malicious code in @nstudio/nativescript-loading-indicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b551e46bc14865c379331dce05e3f6adb61e5f385acc0aa24b912176766d0c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Watch Out for Salty2FA: New Phishing Kit Targeting US and EU Enterprises

Phishing-as-a-Service PhaaS platforms keep evolving, giving attackers faster and cheaper ways to break into corporate accounts. Now, researchers at ANY.RUN has uncovered a new entrant: Salty2FA , a phishing kit designed to bypass multiple two-factor authentication methods and slip past traditiona...

MAL-2025-46991 Malicious code in @duckdb/duckdb-wasm (npm)

The DuckDB Node.js package @duckdb/duckdb-wasm version 1.29.2 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

appRain CMF cross-site scripting vulnerability (CNVD-2025-21112)

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF, which is caused by improper validation of user input by the /apprain/developer/addons/update/ace endpoint. An attacker could use this vulnerability to steal the victim's cookie-based...

appRain CMF 跨站脚本漏洞

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF, which is caused by improper validation of user input in /apprain/appreport/manage/endpoint. An attacker could use this vulnerability to steal the victim's cookie-based authentication...

TamperedChef Malware Disguised as Fake PDF Editors Steals Credentials and Cookies

Cybersecurity researchers have discovered a cybercrime campaign that's using malvertising tricks to direct victims to fraudulent sites to deliver a new information stealer called TamperedChef. "The objective is to lure victims into downloading and installing a trojanized PDF editor, which include...

Malicious Package

Overview postingzon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for...