PT-2025-32239

Name of the Vulnerable Software and Affected Versions Lego versions 4.25.1 and below Description The github.com/go-acme/lego/v4/acme/api package, and consequently the Lego library and command-line interface, does not enforce HTTPS when communicating with Certificate Authorities CAs as an ACME...

Fedora 43 : golang-github-acme-lego (2025-30bf3a7b1a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-30bf3a7b1a advisory. Automatic update for golang-github-acme-lego-4.23.1-1.fc43. Changelog Mon Jul 7 2025 Mikel Olasagasti Uranga - 4.23.1-1 - Update to 4.23.1 and adopt Go Vendo...

SoK: Stablecoin Designs, Risks, and the Stablecoin LEGO

Stablecoins have become significant assets in modern finance, with a market capitalization exceeding USD 246 billion May 2025. Yet, despite their systemic importance, a comprehensive and risk-oriented understanding of crucial aspects like their design trade-offs, security dynamics, and...

Malicious code in vuepress-plugin-lego-analytics (npm)

The package communicates with a domain associated with malicious activity...

Malware in yandex-lego

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in yandex-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36575d1c04d04a70393c42d013dfb94f94d1dd8211785aaa3b08414cdf0fb421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3668 Malicious code in yandex-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36575d1c04d04a70393c42d013dfb94f94d1dd8211785aaa3b08414cdf0fb421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @airtel-lego/sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e126e868d890d40f42157c798a5f6385a6b2cadb73c9a125606b59c79057cfdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2075 Malicious code in @airtel-lego/sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e126e868d890d40f42157c798a5f6385a6b2cadb73c9a125606b59c79057cfdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 41 : golang-github-acme-lego (2024-f6f91d983c)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f6f91d983c advisory. Automatic update for golang-github-acme-lego-4.17.4-4.fc41. Changelog Mon Jul 29 2024 Mikel Olasagasti Uranga - 4.17.4-4 - Update to 4.17.4 - Closes...

scikit-blocks (0.0.1), scikit-lego (0.1.0) +1 more potentially affected by CVE-2024-22421 via jupyterlab (0.35.4)

jupyterlab PYPI version 0.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - scikit-blocks 0.0.1 - scikit-lego 0.1.0 - skillpub =0.2.41, =0.2.90 Source cves: CVE-2024-22421 Source advisory: OSV:GHSA-44CC-43RP-5947...

CVE-2023-37608

An issue in Automatic Systems SOC FL9600 FirstLane V06 legoT04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password...

Malware in shein-lego

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in shein-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ef45c393ee6ca8301bbc37b170265fd5ea03cca45f8e48d8e1c1b085c05665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8523 Malicious code in shein-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ef45c393ee6ca8301bbc37b170265fd5ea03cca45f8e48d8e1c1b085c05665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LEGO Marketplace BrickLink Hacked? Website Down Amid Unusual Activity (Updated)

By Deeba Ahmed BrickLink confirms probing into unusual activity. This is a post from HackRead.com Read the original post: LEGO Marketplace BrickLink Hacked? Website Down Amid Unusual Activity Updated...

Malicious Package

Overview tools-access-lego is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview lego-stuff is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

MAL-2023-896 Malicious code in tools-access-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fddb963172387b40e3adf0f4314fb8b30ed7c12d5d3cf70e1ceb7388987313bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tools-access-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fddb963172387b40e3adf0f4314fb8b30ed7c12d5d3cf70e1ceb7388987313bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...