Arbitrary Code Injection

Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization of RSC payloads from HTTP requests to Server Function endpoints. An unauthenticated attacker can execute arbitrary code ...

Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...

Security Bulletin: IBM Edge Data Collector uses next-15.3.1.tgz which is vulnerable to CVE-2025-55173, CVE-2025-57752.

Summary IBM Edge Data Collector uses next-15.3.1.tgz which is vulnerable to CVE-2025-55173, CVE-2025-57752. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-55173 DESCRIPTION: Next.js is a React framework for building full-stack...

Malicious Package

Overview js-uponcaps is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of this package. Once...

Malicious Package

Overview bitcoin-lib-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in bitcoin-lib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 480dbd7d7ec801a0212ee78ebb73268cd67ba4fb96b06ec563fbafe31aa10531 The package bitcoin-lib-js was found to contain malicious code. Source: ghsa-malware 95f79207062e8c5db317d3487c20f36927b99e9f0b9bfc2551c22a23d10c020f...

MAL-2025-191459 Malicious code in @vleo-dev/a11y-js-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf7b4a5742b82956cf1632de9f435f824ac60651023bec86e0f12d9689dc5b2c The package @vleo-dev/a11y-js-service was found to contain malicious code. Source: ghsa-malware...

Malicious code in @vleo-dev/a11y-js-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf7b4a5742b82956cf1632de9f435f824ac60651023bec86e0f12d9689dc5b2c The package @vleo-dev/a11y-js-service was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199555

Malicious code in @vleo-dev/a11y-js-service npm...

MAL-2025-191402 Malicious code in posthog-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b422f278bf27e062b349e97360b6919e773122f21656f23d6da583ce7cb1a92 The package posthog-js was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199502

Malicious code in @dev-blinq/cucumber-js npm...

Malicious code in posthog-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b422f278bf27e062b349e97360b6919e773122f21656f23d6da583ce7cb1a92 The package posthog-js was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199127

Malicious code in @trefox/sleekshop-js npm...

MAL-2025-191058 Malicious code in @trefox/sleekshop-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5279bf872e21373d0b77ad0fdd98d44c8c59208f43a699e2517e6a5afb899c5 The package @trefox/sleekshop-js was found to contain malicious code. Source: ghsa-malware...

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

Impact In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When sendDefaultPii: true was set, a few headers that were previously redacted - including Authorization and Cookie - were...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-198860

Malicious code in @louisle2/cortex-js npm...

MAL-2025-190817 Malicious code in @louisle2/cortex-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c444e50876d5f75647d843c02c0b22a893e1129c31baca504e57985a07a2f5bb The package @louisle2/cortex-js was found to contain malicious code. Source: ghsa-malware...

Malicious code in @louisle2/cortex-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c444e50876d5f75647d843c02c0b22a893e1129c31baca504e57985a07a2f5bb The package @louisle2/cortex-js was found to contain malicious code. Source: ghsa-malware...

CVE-2025-64718

js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml...