Malicious code in @posthog/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57662af8290901771cf534d8b1ca05ca88dfd84054580144d934f730549a4653 The package @posthog/cli was found to contain malicious code. Source: ghsa-malware e663c40b9060088ff86ea24eec083b9b5bf8afdec2e1963895e47e5177a673d1 A...

GHSA-9MV9-GW4X-7XW4 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-5J98-MCP5-4VW2 vulnerabilities

Vulnerabilities for packages: lerna, ts-patch, py3-jupyterlab, node-gyp, saf, npm, pulumi, prism...

GHSA-6QV9-48XG-FC7F

creationtimestamp| type| source ---|---|--- 2025-11-21 22:26:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115590036421081698...

GHSA-HC35-H924-8596

creationtimestamp| type| source ---|---|--- 2025-11-21 20:12:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115589509189463539...

GHSA-GGXQ-HP9W-J794

creationtimestamp| type| source ---|---|--- 2025-11-21 12:50:48+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3m65d3nacyr2q...

GHSA-46XP-26XH-HPQH

creationtimestamp| type| source ---|---|--- 2025-11-18 22:33:30+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115573077428976929 2025-11-18 22:33:35+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3m5wsaycr7m22...

GHSA-W7XJ-8FX7-WFCH

creationtimestamp| type| source ---|---|--- 2025-11-17 18:45:57+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115566520309269245 2026-07-09 03:00:06+00:00| seen| https://t.me/brutsecurity/2387 2026-07-10 00:00:13+00:00| seen| https://t.me/brutsecurity/2387 2026-07-11...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

GHSA-GRX8-G27P-8HPP

creationtimestamp| type| source ---|---|--- 2025-11-13 17:55:59+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115543674662995941...

GHSA-QWVM-X4XH-G2QQ

creationtimestamp| type| source ---|---|--- 2025-11-13 16:05:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115543241220528720...

CVE-2025-64517

sudo-rs is a memory safe implementation of sudo and su written in Rust. With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10...

GHSA-6FHJ-VR9J-G45R vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-4WHC-3XQP-JPRR vulnerabilities

Vulnerabilities for packages: binutils...

GHSA-W337-WPHV-G4VH vulnerabilities

Vulnerabilities for packages: binutils...

GHSA-77MM-F2XG-RWG2 vulnerabilities

Vulnerabilities for packages: binutils...

GHSA-39HR-239P-FHQC

creationtimestamp| type| source ---|---|--- 2025-11-12 19:13:20+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115538316443414289...

Malicious code in react-icons-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 224e1d5b1a2b01321da822c843e2013f28320e4b9d4d74487daef59c812557f6 The package react-icons-toolkit was found to contain malicious code. Source: ghsa-malware...

GHSA-M6HQ-P25P-FFR2 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, k8sgpt, kubescape, falco-no-driver, envoy-gateway, osv-scanner, rancher-fleet, steampipe, headlamp, chartmuseum, zarf, neuvector-scanner, wolfictl, fuse-overlayfs-snapshotter, gogatekeeper, helm-operator, helm, dagger, kaniko, buildkitd, spegel,...

GHSA-PWHC-RPQ9-4C8W vulnerabilities

Vulnerabilities for packages: consul-k8s-fips, tw, rancher-fleet-fips, falco-no-driver, zot, opa-fips-envoy, k3s, kaniko-fips, k9s-fips, gatekeeper, grype, steampipe, cloudbeat, trivy-operator-fips, kubevela-fips, headlamp, beats-fips, kubevela, headlamp-fips, neuvector-scanner-fips,...