MAL-2025-3967 Malicious code in maddddddterialxtest (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fba69f39bbe6232d97fbed1db9a38bd6a0de496acb93a26672b5bee18a28a307 Any computer that has this package installed or running should be considered...

MAL-2025-3877 Malicious code in codm-onlinematch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5f6fb5867fd54709c01f55a61e5186d80049d7aca83fcfe7b52f4ae562c4af0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3925 Malicious code in vue-gop-authenticate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5f8092f5dd68ba9b719ca6f042e84c396704214bdaff421ce3f8b933fa7e302 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3883 Malicious code in driver-app-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3570e82c82a42968f9af1f2c57c421f5b73880688f83466fc4310325ecb60dff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3916 Malicious code in seagroup-assets-management-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44bc2e3fe919ef26fcd2d1f0c35594c222160c51fff19083d9be40017cc2689 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3900 Malicious code in lcs-ui-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b66ec079f142a51c33d484015aab0384b514dca3415e27b84138f92dd2ea818 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3905 Malicious code in meta-ai-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230f2c424df3ca5115f3d575ba5a15c46f2a591f9a8ed4ec503c6bb5490ea355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3915 Malicious code in rollup-plugin-remove-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230bae792624cf6834a21e884402488ab15faca4797c79b7312463de4faf0593 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3895 Malicious code in interaction-tracing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df3c2eb4540cdd7edb46dc3730a71a443bd1e3e63771f8046407a7f1d3c44e52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3878 Malicious code in com.meta.xr.sdk.avatars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2819b05ade219214d57904bac7d545f37b68824e1a40e52668c7b6751d543c49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3919 Malicious code in solara-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d11917059b5c9bae62b045f1b86da3912936d28e6568bc30ec686779c22da807 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3892 Malicious code in hardhat-configure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77548f696a5d458d665f8134760c4dea58e0b1f7b66856ddc83a4c1096c4a0f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3828 Malicious code in fastifiyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3da19b8f86e82a5ab61d8134531f7e1f001bf858555808eca76c3f03deeff06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3839 Malicious code in momenter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f430e51962da7f325413ad52b7f901ca944587f76401dcc9b3d30f6ab15f5d0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3837 Malicious code in mmsdk-apml-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware babf5466e67db91bc3f90a5ad7449859bd39b7ce9dfb72a73e1ad01d022f3a0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3831 Malicious code in helvetia-base-patterns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3682a1cff47d9425b9d7c8d820704387f078a2f5ee4dadc955da09c859c23579 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

Session Fixation

Flask is vulnerable to Session Fixation. The vulnerability is due to incorrect key list construction and Flask passing the signing key first instead of last, allowing an attacker with access to an old signing key to generate valid session tokens and bypass key rotation...

MAL-2025-3826 Malicious code in defipulse-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d5536c5f6bcb7069516bd2682ee50724915e891c5f1aa5c68ef38d32f9e2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3852 Malicious code in react-native-plugin-ms-adal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 361e4c6581b21fde6eeab43c3e36a75bd051771efd939b92cd3f82fbee601f6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...