Ubuntu 25.04 : Flask vulnerability (USN-7534-1)

The remote Ubuntu 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7534-1 advisory. It was discovered that Flask incorrectly handled key rotation. An attacker could possibly use this issue to sign sessions with stale keys. Tenable has extracted the...

MAL-2025-4539 Malicious code in @fff-web/fff-utilities (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b538001307782f76d2333a860fd4464fcd00ee81502f585e177ec62b0541262 Any computer that has this package installed or running should be considered...

MAL-2025-4366 Malicious code in koishi-plugin-majjan-nanikiri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6887f78c1033e92ccb5aab19fb7c9403c34d9136624def09f8944b43603dfdeb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4341 Malicious code in eslint-typescript-runtime-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be050b4e52992e8c09c9654e29825a2715f4b5a07c8b11c06bcb61163c525354 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4388 Malicious code in plugin-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6894a10f2cae1576d4b28556e817ceae00aa303e12f88eeca933fcc6c0c8f891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-42806

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying $\mathsfcid$ allows an attacker which must be a participant of this head to use a snapshot from an old head instance with the same participants to close the head or contest the state with i...

CVE-2023-47640

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

MAL-2025-4306 Malicious code in btcjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6dc89984b6c5d31e37a51eac0c9ebf6c3e93d8772938d44ac1051bffbda8962 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4348 Malicious code in fs-path-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bbb0034c7f631436e49a1e2a5c4a5f80204c56e46a101701eeb40d7947eb39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4363 Malicious code in internalwkl-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 929f2a7e5622ef6954156300b8095508bdebc3f69573d35fdcdb9785504809ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4314 Malicious code in client-microsite-reactjs-controls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e7614cd043fdaba853ac20fee4ef3aaa1ff2d0cc51534ca1ab3bc89a636d654 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4371 Malicious code in leetrjohn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a91ba15bd1785240f04a28a2c445d1f0bd6972f9d3fc48fd6b0511aad6757c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4340 Malicious code in eslint-config-rth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ada83835d1a1d917e96a39accdde75a1be468e8f7c6dffdbe72b44e9941223c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4400 Malicious code in seatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534db55497a58d9007903dfa5dfe418fd37c2ab3ef4a8a47567e44e3a7ada101 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4300 Malicious code in appium-rn-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef7cb1de288405a6192295e5c90cd73f988b36e415534e40d460c8add2635066 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4358 Malicious code in hermes-inspector-msggen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c888d12bd2fd1107fe758f38e0e220f18fe717c6524edc4edc0478727a63bf6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4417 Malicious code in wsticket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7332aa1bc786ac92ad941e301b7f14c28be71906774177abcf327c06dd9021b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4396 Malicious code in routing-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7eae6c038e57303bb89b61fbc6cafc447118487b55c2eeaefb7c52ae128a2310 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4330 Malicious code in customer-center (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b07f04df811b9a1153761f420a42baae02589eb630664403d8be7ce774481d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4399 Malicious code in seamless-sppmy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0389a6eb1c890ee2de52f64fe14cf1cea2bf0a952bfabdde2686784ddaece9ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...