CVE-2025-14942

wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier. Users of wolfSSH must...

Snipping the Long Tail of Shai-Hulud 2.0

Wiz Research reveals the data behind Shai-Hulud's 2.0 long tail, the massive gap in cloud credential rotation, a potential link to the Trust Wallet incident, and how we finally "snipped the tail" on a month of ongoing infections...

@actbase/react-native-naver-login contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Malicious code in pensions-portals-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9025d84d3de41f55102920c25c5229e8104e159e23a3e943a7e955077ae61403 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @js-to-lua/handler-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecbb26f98b0d1520a3801861e0c434568d5ac1958606124e217a6e10eda3c436 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lazy-loading-router-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e86c543eb73f7bba257e00eb5c1e644a38195948dacb89094dc45204e6d8d8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/sit-omnis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b9a0da163a27e31a36cf080792e481a210e52e47b9b8a31d59a2943ccd64d5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37150 Private npm registry support used scope auth token for downloading tarballs

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private...

MAL-2024-1113 Malicious code in action-and-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0df7d68df29c8d0451564e890d6a9e4e49ed0d52b81b51c81ab79c1bb6fabac3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wasabi-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a47529c7afca95337513fc02161d3429f5b5e4fa1ff3f80484688148b152ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hardhat-web3-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 736287dd58e487359e35a7c53653af7140c45ca2919d533e02fb45b58e898dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2021-37698

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate...

Malicious code in canavs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13e128e52970ec45038ca9745bdf6ea9fcd4747dff1a569778f19b07bc7d28b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in psaqko (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f46d9292e9dfb79641894e17c4a5615fdc11389b7ddfb87014f4b47daebfe8be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rvbxthpadlowmfji (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1936e2b03db8986ac8a2e50c69fb0b237fc39547ceb4d4235b035cf6332a4d1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fbsystem/figma-messenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71addafc4195bb495c6b65e56d535eb02c90e7fdc06b56a35ca98d98555c644a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2021-37698

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate...

UBUNTU-CVE-2021-37698

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate...

Malicious Package

Overview The package ac-addon contained malicious code. The package ran a postinstall script that executed two .exe files. Both files were identified to contain Trojan malware. Recommendation Remove the package from your system and rotate any credentials that may have been compromised. References...

Malicious Package

Overview The package discord.dll contained malicious code. The package ran a postinstall script that exfiltrated local files such as browser local databases. The information was exfiltrated to a remote Discord webhook. Recommendation Remove the package from your system and rotate any credentials...