GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

EUVD-2026-50096

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

Malicious Package

Overview color-convert-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11149 Malicious code in streak-core-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073175f6a0065dc5cc00d30357053432c69fbc7aab8b92bbe4217ad3d54c5d3a index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip, unzips it into...

Malicious code in lib-streak-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...

Malicious Package

Overview date-sanitize-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview num-format-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview array-sort-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Root-My-Device-Payloads

Root My Device Payloads A fork of BuSung-dev/Root-My-Galaxy-...

Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

MAL-2026-11118 Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

Malicious code in num-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a0ecb436de3a0e93a577a3ba1733b227bd536e02acf371df530c6a320e1001 Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via...

MAL-2026-11107 Malicious code in num-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a0ecb436de3a0e93a577a3ba1733b227bd536e02acf371df530c6a320e1001 Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via...

Malicious code in date-sanitize-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...

MAL-2026-11106 Malicious code in date-sanitize-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...

Malicious Package

Overview solc-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview glob-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview nock-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview data-format-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview chai-plugin-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...