MAL-2025-48961 Malicious code in @decentraland-gatsby/intl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c478ce47e595b70be3bf3ed4905775006b6e270a90bbbea45698e1817c8315ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36797

Malicious code in @decentraland-gatsby/intl npm...

Malicious code in @decentraland-gatsby/intl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c478ce47e595b70be3bf3ed4905775006b6e270a90bbbea45698e1817c8315ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @decentraland-gatsby/intl is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in decentraland-credits-squid (npm)

The package decentraland-credits-squid was found to contain malicious code...

MAL-2025-18150 Malicious code in decentraland-credits-squid (npm)

The package decentraland-credits-squid was found to contain malicious code...

decentraland-gatsby (>=5.76.0 <=5.77.1) potentially affected by CVE-2023-41049 via @dcl/single-sign-on-client (=0.0.13)

@dcl/single-sign-on-client NPM version =0.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on @dcl/single-sign-on-client and may be impacted: - decentraland-gatsby =5.76.0, =5.77.1 Source cves: CVE-2023-41049 Source advisory: OSV:GHSA-VP4F-WXGW-7X8X...

Single Sign On Client Cross-Site Scripting Vulnerability

Single Sign On Client is an open source single sign on client from Decentraland. A cross-site scripting vulnerability exists in Single Sign On Client versions prior to 0.1.0 that originates from improper input validation and allows execution of arbitrary JavaScript...