MAL-2025-3716 Malicious code in crypto-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e212ce9343535d644b46e13584a4a6c0585b2c5482091ca23ea52068b582048e The OpenSSF Package Analysis project identified 'crypto-utility' @ 0.3.4 npm as malicious. It is considered malicious because: - The package...

MAL-2025-3598 Malicious code in font-impact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 404db1db5b86b6ce6ed40f2169b12625d010c431f4610548c55dc053f5d43d69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3596 Malicious code in @ringcx/agent-mfe-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32dc26e905c6298ce020698678835f03f2e5dfb8c63366729ba9e638b98d5abc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3593 Malicious code in client-utility-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3ea30b384f30ddf174344cda1da28874f1f377efed1f312b34ba56b7bedd7aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3574 Malicious code in aegis-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 012d98d433c475ff3012368e49e74b54c587fd81749e936cc898ba80a4d8d868 The OpenSSF Package Analysis project identified 'aegis-contracts' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-3560 Malicious code in rei-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af31c87d2d807d5845662ad08b32fdf03d8b63c355e3bcf91abd5642a6313eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3564 Malicious code in @di-sdk/quickselect-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb4f93b792159c059a742b5ea3d59a8038b8e1be1103e430086184a2f3ca3090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3399 Malicious code in freo-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8745e789b7b101fb7ede2f6f26567a39b6ec9522c2f6cad7f182098661442ced The OpenSSF Package Analysis project identified 'freo-design-system' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...

MAL-2025-3296 Malicious code in @template-builder/iframe-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d449b73ecd5ceb50edae265044e9523e1608eafa7389e2e46f139ea57a4e37aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3295 Malicious code in bvr-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ed2a0f9c584ecfcffc1c76619a1637559d1d8771f78e1d3655f819f7fff67962 The OpenSSF Package Analysis project identified 'bvr-api' @ 0.3.12 rubygems as malicious. It is considered malicious because: - The package...

MAL-2025-3279 Malicious code in sprocket-webapp-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f5d57baf1c9d4921b97830956bc52be3915cbc7653c64569768d18c5583c845a The OpenSSF Package Analysis project identified 'sprocket-webapp-poc' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

MAL-2025-3268 Malicious code in arubaiothubdemoapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 876ff25e0242422681fb71c6ba92f36b79e0584103fae49a5bffdd959497485b The OpenSSF Package Analysis project identified 'arubaiothubdemoapp' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

SUSE-SU-2025:1201-1 Security update for expat

This update for expat fixes the following issues: - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618 Other fixes: - version update to 2.7.1 jscPED-12500 Bug fixes: 980 989 Restore event pointer behavi...

MAL-2025-3174 Malicious code in typesense-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 490e72092d3e2b725ff92c6b8bb87fb850509bdd1abbead8e8cb9427a4d92bcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3176 Malicious code in @n37scancp/highlight.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 944af106fc0b2a334ed1ab4fb6784a0b2cc01e5f795b1de3449b8deaf6560b50 The OpenSSF Package Analysis project identified '@n37scancp/highlight.js' @ 11.11.12 npm as malicious. It is considered malicious because: - The...

MAL-2025-3136 Malicious code in clarunit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aecdc65ad87798f6243b3d284367e755b52beb5eef68fcc0ca08b0b802230643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3132 Malicious code in internal-utils-bronxi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2c2b247fbdf1610b485929f50b7e3394cf7f7d524a747b5941f0c64563f4407 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3130 Malicious code in @oldzeppelin/contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59936093e10e486bceef6e021a4ca771a2996cf612a809e2bea28243348f8968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3129 Malicious code in scrt-www (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c3dc483e4a4005db4d3a5ec2f2b2e8d63aa5b8258510f483ce9d4c7351b2c84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3128 Malicious code in @fraudprevention/device-intelligence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4499ba2c16cf02f2e12c45bba95e21bd588726f331f7a7a7f8eecfbb0369cafc The OpenSSF Package Analysis project identified '@fraudprevention/device-intelligence' @ 100.99.100 npm as malicious. It is considered malicious...