PT-2025-39287

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2025.4.0 through 2025.5 Description The encryption key for the Infra Assistant database was not excluded from Puppet backups in Puppet Enterprise. This key is only present if a Puppet Enterprise Advanced license is...

CVE-2025-10360: Insufficiently Protected Credentials

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

Malicious Package

Overview newrelic-infra-operator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in newrelic-infra-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d13f7915d1227dc54cc2f1481a151b94b159d4ec2941d00db71133b636b5ed1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47193 Malicious code in newrelic-infra-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d13f7915d1227dc54cc2f1481a151b94b159d4ec2941d00db71133b636b5ed1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2015-8559

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages. CVE-2015-8559 Note that...

Linux Distros Unpatched Vulnerability : CVE-2023-28864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode- cache/backup world-readable temporary backup path to...

Malicious code in yelp-js-infra (npm)

The package yelp-js-infra was found to contain malicious code...

MAL-2025-7840 Malicious code in @epc-infra/vpc-stack (npm)

The package @epc-infra/vpc-stack was found to contain malicious code...

Malicious code in test-mlw1-azyme-woody-infra-baulk (npm)

The package test-mlw1-azyme-woody-infra-baulk was found to contain malicious code...

Malicious code in test-mlw2-azyme-woody-infra-baulk (npm)

The package test-mlw2-azyme-woody-infra-baulk was found to contain malicious code...

Malicious code in @epc-infra/cognito-stack (npm)

The package @epc-infra/cognito-stack was found to contain malicious code...

MAL-2025-7836 Malicious code in @epc-infra/cicd-stack (npm)

The package @epc-infra/cicd-stack was found to contain malicious code...

MAL-2025-34772 Malicious code in test-mlw1-azyme-woody-infra-baulk (npm)

The package test-mlw1-azyme-woody-infra-baulk was found to contain malicious code...

MAL-2025-34920 Malicious code in test-mlw2-azyme-woody-infra-baulk (npm)

The package test-mlw2-azyme-woody-infra-baulk was found to contain malicious code...

Malicious code in @epc-infra/lambda-utils (npm)

The package @epc-infra/lambda-utils was found to contain malicious code...

MAL-2025-23223 Malicious code in infra-kafka-agent (npm)

The package infra-kafka-agent was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, kube-rbac-proxy, kratos, step-fips, gotestsum, neuvector-fips, step-kms-plugin-fips, prometheus-stackdriver-exporter, rancher-security-scan, gobump, opentelemetry-collector, vault-env, undock, weaviate, prometheus-postgres-exporter-fips,...

USN-7654-4 linux-kvm vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PA-RISC architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; -...

MAL-2025-4746 Malicious code in infra-metrics (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e834dce6687a994025a897f7ab4b0c72fb30033eafd9999cbea3608f5eb6a268 Any computer that has this package installed or running should be considered...