Arbitrary Code Injection

Overview @cocalc/frontend is a CoCalc: Collaborative Calculation Affected versions of this package are vulnerable to Arbitrary Code Injection via uploading a crafted SVG file. An attacker can execute arbitrary code by uploading a specially crafted SVG file. Remediation A fix was pushed into the...

Malicious Package

Overview frontend-cron is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-41705

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

EUVD-2025-34146

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

PT-2025-41855

Name of the Vulnerable Software and Affected Versions Webfrontend affected versions not specified Description An unauthenticated remote attacker performing a man-in-the-middle MITM attack can intercept websocket messages. This interception allows access to login credentials for the Webfrontend. T...

Malicious code in dt-frontend-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d84c9e90fa62a28e4b2b22f78ffa732463fd6351f426e71f105661f00179e4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frontend-photoswipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08a30dcf287f7992949bf9a4870c6201c42b3aa3b59e0966a677899b4bca376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33610

Malicious code in frontend-layout npm...

Malicious code in frontend-prevent-open-redirect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d7d715ee921f7aa5445a7b69d8ee16f1c90ff529d86220f569ab70de2afa71e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33612

Malicious code in dt-frontend-utils npm...

EUVD-2025-33606

Malicious code in frontend-prevent-open-redirect npm...

Malicious code in frontend-google-tag-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4f6a0228c6c8a63f058b39d72aa7f23d1f92b03e46a8f5dff1b1f856bbb6306 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33611

Malicious code in frontend-google-tag-manager npm...

MAL-2025-48279 Malicious code in frontend-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd81764709c7d0f5174dd0a979519b3c85894302b3df75acedbf1de8500d3c07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview frontend-metrics-collector-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious code in frontend-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd81764709c7d0f5174dd0a979519b3c85894302b3df75acedbf1de8500d3c07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33607

Malicious code in frontend-photoswipe npm...

Malicious Package

Overview dt-frontend-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in frontend-metrics-collector-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33df4b3fc95229c6a1af21ef46dd94df8a0c7f647459b6b83dd1a92149afbbdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview frontend-google-tag-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...