18 Popular Code Packages Hacked, Rigged to Steal Crypto

At least 18 popular JavaScript code packages that are collectively downloaded more than two billion times each week were briefly compromised with malicious software today, after a developer involved in maintaining the projects was phished. The attack appears to have been quickly contained and was...

Amazon Linux 2023 : cairo, cairo-devel, cairo-gobject (ALAS2023-2025-1172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1172 advisory. An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream objects is not cleared upon program exit, allowing attackers to obtain sensitive PDF content via a memory...

MAL-2025-46257 Malicious code in test-kiota-typescript-libraries (npm)

The package test-kiota-typescript-libraries was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in test-kiota-typescript-libraries (npm)

The package test-kiota-typescript-libraries was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

[SECURITY] Fedora 41 Update: udisks2-2.10.2-1.fc41

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies...

CVE-2025-41050

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/baselibs...

Memory exhaustion in multipart form parsing in net/textproto and net/http

...

Revisiting Third-Party Library Detection: a Ground Truth Dataset and Its Implications across Security Tasks

Accurate detection of third-party libraries TPLs is fundamental to Android security, supporting vulnerability tracking, malware detection, and supply chain auditing. Despite many proposed tools, their real-world effectiveness remains unclear.We present the first large-scale empirical study of ten...

Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.

...

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute...

Foxit PDF Reader PDF Search Path Privilege Escalation

The vulnerability of the PDF document viewing program Foxit PDF Reader formerly Foxit Reader and the PDF file editing program Foxit PDF Editor formerly Foxit PhantomPDF is related to an uncontrolled search path element. Exploiting this vulnerability can allow attackers to enhance their privileges...

Linux Distros Unpatched Vulnerability : CVE-2022-2986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. CVE-2022-2986 Note that Nessus relies on the presence...

[SECURITY] Fedora 42 Update: udisks2-2.10.91-1.fc42

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies...

CVE-2025-58322

NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks...

MAL-2025-41457 Malicious code in @sfdc-www-emu/clientlibs-web-components (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @sfdc-www-emu/clientlibs-web-components (npm)

--- -= Per source details. Do not edit below this line.=-...

Linux Distros Unpatched Vulnerability : CVE-2020-28590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A...

@jill64/svelte-dark-theme (>=2.3.65, <=5.1.7), @jill64/svelte-i18n (>=1.1.27, <=2.2.1) +9 more potentially affected by CVE-2025-57820 via devalue (>=5.0.0, <=5.1.1)

devalue NPM version =5.0.0, =2.3.65, =1.1.27, =1.1.21, =1.2.263, =2.2.3, =0.0.2-dev.84, =1.0.23, =1.0.22, =1.0.0, =1.0.6, =2.1.10, =2.1.15 Source cves: CVE-2025-57820 Source advisory: OSV:GHSA-VJ54-72F3-P5JV...

[SECURITY] Fedora 41 Update: python3.13-3.13.7-1.fc41

Python 3.13 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

Malicious Package

Overview bitensor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency from...