MAL-2025-191046 Malicious code in @osmanekrem/bmad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944b38bf9ed936861ce98cafc711d3d8a8b9cacdc551e5ea1142ea4143cb60aa The package @osmanekrem/bmad was found to contain malicious code. Source: ghsa-malware 4ec958dd0f9ea68f75efc0bfd5d3c3af3b068c9bd15c3a1806453debabae0a...

Malicious code in wallet-type (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53103558dbb7f0fa15aed8747785784f2e4483cb8a2dc5356bb51f88b557e42c The package wallet-type was found to contain malicious code. Source: ghsa-malware a6b9e10473762dd8f4f65c9dbd42b4fd51094b526f5d6962441f415683799c50 An...

Malicious code in victoria-wallet-type (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db5621bc10f18615bd2282fd957a36730167a4e9318f35873c35258f033b2aad The package victoria-wallet-type was found to contain malicious code. Source: ghsa-malware...

Malicious code in email-deliverability-tester (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d5f649d3b599b504b29b284fa8a5c5a71d305b58d63d38f2ee3c9202eb982 The package email-deliverability-tester was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/ccip-read-cf-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd3f5e0ef4b518b71e371b472de64525c90fa98305becf54d8e15279e4d5d766 The package @ensdomains/ccip-read-cf-worker was found to contain malicious code. Source: ghsa-malware...

Malicious code in gate-evm-tools-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f11f5364b5246431e888b7293099cd8833dbcdd463cc7ce7d1aeabdc066faa5a The package gate-evm-tools-test was found to contain malicious code. Source: ghsa-malware...

Malicious code in @actbase/react-kakaosdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a48797e2088e681febf91726aa184436bf3fa96104d23f438a11b19f75ef0516 The package @actbase/react-kakaosdk was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190807 Malicious code in @ensdomains/name-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfefd8b0b2d182a283e0934b365d98833a12639552eab96ebe6b69572c15c0d The package @ensdomains/name-wrapper was found to contain malicious code. Source: ghsa-malware...

Malicious code in skills-use (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f974e3dc3206af78c8a6fd5370b73dc14d8edc1f052caa4992fdca5c5bac45ac The package skills-use was found to contain malicious code. Source: ghsa-malware 25e55ca30592985c5f31158f8bd68d19643e2b48db1cf4578a7da6ae380ed661 Any...

Malicious code in exact-ticker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73836084382b05119a191e8cca9859cc6d1233d4438d1d89b016447c822b7a3 The package exact-ticker was found to contain malicious code. Source: ghsa-malware f79afea8081e5bfa7bd2122f78ff54b8eccb0c1516de1a9c14a19a3ca7d2ffa6 A...

MAL-2025-190634 Malicious code in @validate-pubkey/hex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05db2afe6b0d7557f2c2153dd15df68ab69667e8402bf92f2b2e2d900eb5728f The package @validate-pubkey/hex was found to contain malicious code. Source: ghsa-malware...

Malicious code in loliloli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49613dc24146ca83bc9bd4c3192468ff9b16fc61797e4b79a957d79f98d3552b The package loliloli was found to contain malicious code. Source: ghsa-malware 6188273fee11225ff9b29efe7923768ac1792c131fd40768f5127839c6be6ceb Any...

Malicious code in com.unity.polyspatial.xr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f47a6bc79a20cf499736b6544281ecd6035fd1135b3d465ea2b7579061bfc2b The package com.unity.polyspatial.xr was found to contain malicious code. Source: ghsa-malware...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

CVE-2025-63223

The Axel Technology StreamerMAX MK II devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

CVE-2025-63225

The Eurolab ELTS100UBX device firmware version ELTS100v1.UBX is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized...

Axel WOLF1MS和Axel WOLF2MS 安全漏洞

Axel WOLF1MS and Axel WOLF2MS are both FM network monitoring devices from Axel Italy. A security vulnerability exists in Axel WOLF1MS and Axel WOLF2MS versions 0.8.5 through 1.0.3, which stems from a lack of authentication in the /cgi-bin/gstFcgi.fcgi endpoint, and could lead to a complete crack ...

CVE-2025-63218

The Axel Technology WOLF1MS and WOLF2MS devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

CVE-2025-63223

The Axel Technology StreamerMAX MK II devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

Axel StreamerMAX MK II 安全漏洞

Axel StreamerMAX MK II is an audio codec device from Axel Italy. A security vulnerability exists in the Axel StreamerMAX MK II versions 0.8.5 through 1.0.3, which stems from a lack of authentication in the /cgi-bin/gstFcgi.fcgi endpoint, and could lead to a full crack of the device...