MAL-2025-69126 Malicious code in lexical-crimson-hummingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d1130972238df5559e663a88c0bf242a0a71cb718305cd4be0e67e110a84611 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53524

Malicious code in lexical-azure-hornet npm...

EUVD-2025-49918

Malicious code in lexicalkiwiz3n npm...

EUVD-2005-2983

Malware in sbrugna...

EUVD-2010-0665

Malware in sbrugna...

EUVD-2021-33026

Malicious code in bioql PyPI...

EUVD-2021-33030

Malicious code in bioql PyPI...

EUVD-2025-11857

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-26194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecmaislexicalenvironment in the ecma-helpers.c file. CVE-2021-26194 Note that...

Linux Distros Unpatched Vulnerability : CVE-2023-48183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - QuickJS before c4cdd61 has a buildforiniterator NULL pointer dereference because of an erroneous lexical scope of this with eval. CVE-2023-48183 Note that Nessu...

CVE-2023-30792

Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...

CVE-2025-32792 ses's global contour bindings leak into Compartment lexical scope

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...

GHSA-H9W6-F932-GQ62 ses's global contour bindings leak into Compartment lexical scope

Impact Web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used const, let, and class bindings in the top-level scope of a tag will have inadvertently revealed these bindings in the lexical scope...

Malicious code in eslint-plugin-lexical (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 760c1ce48f24649d849a333e359e0a3f348f36df412163d82b89e8fc552625f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2670 Malicious code in eslint-plugin-lexical (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 760c1ce48f24649d849a333e359e0a3f348f36df412163d82b89e8fc552625f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lexical-esm-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808bb38341306bbd08d655abd9928c5cf279412658db15774579d78f195f5a39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-X8JH-XJ3X-GX3C `fast-float` has multiple soundness issues

fast-float contains multiple soundness issues: 1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees The library is also unmaintained. Alternatives For quickly parsing floating-point numbe...

Multiple soundness issues

fast-float contains multiple soundness issues: 1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees The library is also unmaintained. Alternatives For quickly parsing floating-point numbe...

lexical-core has multiple soundness issues

RUSTSEC-2024-0377 contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls...

GHSA-2326-PFPJ-VX3H lexical-core has multiple soundness issues

RUSTSEC-2024-0377 contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls...