Malicious code in debug-toolbar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57a187231b24ff90938749793a1f8f768e606a7fe5da9d2c6d74510419c14ed0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in sap-adv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5935ab744274c1707e0477f65c8639076dc9448a4add5aad7fe2466cf5ee14db The OpenSSF Package Analysis project identified 'sap-adv' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...

Robotmk Security Vulnerabilities

Robotmk is an open source Robot framework integration for Checkm k by ELABIT. A security vulnerability exists in Robotmk versions prior to 2.0.1, which stems from a shared holotree usage feature that allows any user to edit any Python environment, resulting in elevated privileges for the local us...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

Malicious code in soundcloud-scrape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49aa7d872acd9b91dd62d1aec545292c8d638126b53eadcc46435726c1c4215a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uui-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20e448a4d82eef5d5f76dd3f8c325358b3b2df9e1d124b28a4a2843f466cb94a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sourcify-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b9df2af027b2402dd66d002eec5cfbf3b37918861883becfce5f43127483c9be The OpenSSF Package Analysis project identified 'sourcify-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in discord.js-self-v22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 672d9ccd18153a9163f1f9a63ec5d765f412cf86a198d526fb04ecc5aa6eab3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-self-v21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7ff51b0a254299fbcba44e692ad912d759a48d835ffcb10759424392b1debdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-48796

creationtimestamp| type| source ---|---|--- 2023-12-16 14:48:00+00:00| seen| https://t.me/ctinow/155412 2025-11-28 07:40:54+00:00| seen| https://seclists.org/oss-sec/2025/q4/215 2025-11-28 10:24:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m6oo6f2zvs2g 2026-04-09...

Malicious code in orchestrationdesk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7c4b49b3a4dec106baa72132f15b7493b62457fa4f2bc0c4bf2ddfe83e58ea9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ifl-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15d842c50e1aff05fb5874d61c1f60e5a803cc51a39cda09deb405e5c6935bce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in watchman-search-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9d31c46bc906a3eeb18b4852518f529d915f87ab7935775541759d38c18151e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-blade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aae9177af783553501be9b3995cd5eebfa3a3aaef47e65237aa9f29e4630b64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

Google has announced that it's expanding its Vulnerability Rewards Program VRP to compensate researchers for finding attack scenarios tailored to generative artificial intelligence AI systems in an effort to bolster AI safety and security. "Generative AI raises new and different concerns than...

Malicious code in investing_parameters (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9827965058f01ec3e66fcbdc4535f495204a620a07ac3687dd39853f9436814 Source: ossf-package-analysis 3fa4a6c4b0b94b2b009c0377390aeee029c2d9024af134c4697f3c8cdfb1f916 The OpenSSF Package Analysis project identified...

Malicious code in tecno-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 031d3e0a1576d7fedc52920ce24b349bbcefa4fc7c381855f1bcbdc0b82a4dd6 The OpenSSF Package Analysis project identified 'tecno-new' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in coveo-101-commerce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc0cdf6355009bbf0e2512408fb6f96d5c1febe666618b3aece404301afc171f The OpenSSF Package Analysis project identified 'coveo-101-commerce' @ 3.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in pack-123-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 147b1fbc2985e829ebc40869208b16815788e67b83a8670679e6399dd6515755 The OpenSSF Package Analysis project identified 'pack-123-new' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in client-ws-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32231907789db551e533776ab68a4a01f4029a0723291d70d65927559eb647d2 The OpenSSF Package Analysis project identified 'client-ws-app' @ 5.20.20 npm as malicious. It is considered malicious because: - The package...