MAL-2025-14551 Malicious code in anonsurf (npm)

The package anonsurf was found to contain malicious code...

MAL-2025-12850 Malicious code in @zalastax/nolb-osi (npm)

The package @zalastax/nolb-osi was found to contain malicious code...

MAL-2025-30769 Malicious code in proto-ui-shell-test (npm)

The package proto-ui-shell-test was found to contain malicious code...

MAL-2025-27010 Malicious code in mystic_xstjf_331qw_pine (npm)

The package mysticxstjf331qwpine was found to contain malicious code...

MAL-2025-11483 Malicious code in @zalastax/nolb-flam (npm)

The package @zalastax/nolb-flam was found to contain malicious code...

MAL-2025-22729 Malicious code in how-to-npm-tester-lee (npm)

The package how-to-npm-tester-lee was found to contain malicious code...

MAL-2025-30185 Malicious code in project-gjy3v-honeydew (npm)

The package project-gjy3v-honeydew was found to contain malicious code...

MAL-2025-20795 Malicious code in fornax-express-package-metalsmith (npm)

The package fornax-express-package-metalsmith was found to contain malicious code...

MAL-2025-29687 Malicious code in process-standard12 (npm)

The package process-standard12 was found to contain malicious code...

MAL-2025-19427 Malicious code in electrkon (npm)

The package electrkon was found to contain malicious code...

MAL-2025-22675 Malicious code in hotel-c43-project (npm)

The package hotel-c43-project was found to contain malicious code...

MAL-2025-191823 Malicious code in prof-tg-dggrto-qu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a9dba23d808b6cdccaa1ceb5d393dd3b7774d71a2fdcde19ef7e1ea927a386ce Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

MAL-2025-191821 Malicious code in prof-qux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5b87af8d8f13bd43c1cf3490ea551b8d60fe05a482875597ef2fe5d2c200ca19 Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

MAL-2025-191746 Malicious code in hahabott (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89ed03d9e80d4ef62c54087a12177f795e478b1b5e5a8af69ef4e4740e102186 If run as module, it attempts to automatically destroy user's and system's files. Some versions also exfiltrate them. --- Category: MALICIOUS - The campaign ha...

GHSA-X6PH-R535-3VJW apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666: bash-5.3 find / -type f -perm -o+w /etc/ld.so.cache This issue was introduced in commit 04f37e2 "generate /etc/ld.so.cache 1629"v0.27.0. Impact This potentially allows a local unprivileged us...

MAL-2025-191811 Malicious code in paradox-pydevdeps (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ffb02e4aaa239e465a9365307dc9f04e5d881cc9f56bd34a1112ce87db7998bc Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-191698 Malicious code in callistopy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c45e190afdbbb8d4b817c50734f8b01bc3bec65978141d4070ca2ec60be6b061 Package creates a telegram client which silently exfiltrate user's Telegram data, including sessions and configuration, to a hardcoded remote target ---...

Malicious code in arc-offsec-custom-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acb3bbd394d6b00a6c9c608c0692c0c3748162b099b5eab871667f3bca061a2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-36923

SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application...

CVE-2017-17809

In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forci...