MAL-2025-258 Malicious code in vuepress-reading-time-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bc2173cdec2761003cb14e94e23dc4759392b467f4f45b62ec5afd7c2353d96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-192 Malicious code in glance-android-core-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f082498ee8cee22569a9d952f86e51b833f15f9ddf0ae457b87367e28bcf198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-166 Malicious code in bbm-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adff756b9b1415f9a70c8273fea0bc9454bc3b33abb4efb2778559d480cdcb5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-257 Malicious code in vue-loader-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c22e5d514334329c3b75f951d755b2a3ef9e122863f7c437530413cd6c49b986 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-264 Malicious code in zk-settlement-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc5c0e7114cd5103b7bbb1048043f0f28d424474ea5070f1024ffcda2f8309f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-263 Malicious code in zd-css-bedrock (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f5ed19a04835661c3c757cb19d1a1a55f869af076879b44b2c84cd0e66f9fd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-253 Malicious code in tree-sitter-pkl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5692ca694e95779acafae807b9a6cd3b419e1b284ff21a64c2b91025f525de06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-210 Malicious code in nimiq-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79b8f1d025e9b377e0680ad86facb0ea1fdf8275c2759fd21838107b58b30d41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-152 Malicious code in ad-shield-essential (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52a7e1710e2d79d0dbdce080eb340926c5b9099faea1b5116d16c5620e04a278 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-23209

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a...

CVE-2025-23209 Potential RCE with a compromised security key in craft/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a...

MAL-2025-111 Malicious code in web-prototyping-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a14e26877ba590485f30ac33a914cfaa213c85de0503b2ff68bd4d9debc5e0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-83 Malicious code in ebay-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d19ac42f1b12b95f81ed89c55872795f9fceb4ea498c981624eb1eb04828bcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-109 Malicious code in uber-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddfbcc0bce009349873248f526418b14cb9c9f9b575e74b3fc1787fda4af9b76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-82 Malicious code in data-planning-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67fe067d2513628f7ed4c690b0cae73973b9e436a6947604ea1d714bd7c4a70b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-95 Malicious code in olivergreen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93149667e62337ce494ebf287aeb4ab68a2b6b96fc9d32b5262d381771b539e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-114 Malicious code in zqdl55511 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce97905db0b38ee627d1c55a3e9edbec0760eda87837942a4cdc0ef0ae0f5a60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-12108 WhatsUp Gold - Public API signing key rotation issue

In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API...

CVE-2024-12108 WhatsUp Gold - Public API signing key rotation issue

In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API...

MAL-2024-12167 Malicious code in @swiggy-private/dls-web-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 866e9fd01cfe3133ef1ad9f34a13b577f9296d283c389de22605e996c5ff2de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...