2340 matches found
Malicious code in elf-stats-cocoa-train-606-pwn2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b2f0588d3a0e33bfd993faa485a07e4cd60d4c7efb4c33ed006e9c29f20c50 The package elf-stats-cocoa-train-606-pwn2 was found to contain malicious code...
Malicious code in elf-stats-silvered-bauble-482 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873d00a53b6593aa2b1ce0a02b07bf8019709b24cd2f6242548b58408ec99240 The package elf-stats-silvered-bauble-482 was found to contain malicious code...
Malicious code in karem4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1d3bd676881934532a2e75fd644e22b2e4f26fb08bde6d48ff6d529de7467d The package karem4 was found to contain malicious code. Source: ossf-package-analysis b843a0d849da7453ce803b77a117a501a3b1e4b04eae8222d3b59d48438931c...
CVE-2025-13638
Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Low...
CVE-2025-13632
Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. Chromium security severity: High...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...
Malicious code in @ensdomains/ccip-read-cf-worker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd3f5e0ef4b518b71e371b472de64525c90fa98305becf54d8e15279e4d5d766 The package @ensdomains/ccip-read-cf-worker was found to contain malicious code. Source: ghsa-malware...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...
Malicious code in @darwinex/react-custom-scrollbars (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c14e6f6b8558a92600a6b705cd18fbcfc9eca9a163fcd69c792492154fbe37e The package @darwinex/react-custom-scrollbars was found to contain malicious code...
Malicious code in @grumpycoffeecup/hello-npm-world (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a093b0e1fa1064f7696cf7ea0b583ffaf5470026f8c5da1613204168b33b09ed The package @grumpycoffeecup/hello-npm-world was found to contain malicious code. Source: ghsa-malware...
CVE-2025-13228
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
EUVD-2025-176960
Malicious code in proxima-neptune-altair-neptune npm...
EUVD-2025-175555
Malicious code in whitedwarf-tectonic-izar-hermes npm...
EUVD-2025-180221
Malicious code in auth0-sociobiology-apollo-umbra npm...
EUVD-2025-178006
Malicious code in luminescence-pino-superagent-axios npm...
EUVD-2025-179129
Malicious code in enif-terser-webpack-plugin-sass-loader-spectron-webdriver npm...
MAL-2025-189114 Malicious code in redshift-nebula-cz-conventional-changelog-fornax (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf33e7a660e7f12a243bf4ae70b1401a0f4b66ec86a8c2aa5e877f46d3750826 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...