MAL-2025-3126 Malicious code in whatwg-node-fetch-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f59eebf54f348e9ae3e94af39368c59899516438f8b029e4db2d91f075ac95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27789

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement...

UBUNTU-CVE-2025-27789

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement...

CVE-2025-27789 Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement...

CVE-2025-27789 Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement...

MAL-2024-11408 Malicious code in nodes-polyfill-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in nodes-polyfill-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in node-polyfill-webpack-plugins (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11407 Malicious code in node-polyfill-webpack-plugins (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in bsc-stdlib-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis df99335a79394c76ec65c4c11bd937510961ba93b67e631d560753ab61a735b6 The OpenSSF Package Analysis project identified 'bsc-stdlib-polyfill' @ 0.0.1 npm as malicious. It is considered malicious because: - The packag...

MAL-2024-8900 Malicious code in bsc-stdlib-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis df99335a79394c76ec65c4c11bd937510961ba93b67e631d560753ab61a735b6 The OpenSSF Package Analysis project identified 'bsc-stdlib-polyfill' @ 0.0.1 npm as malicious. It is considered malicious because: - The packag...

SUSE CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

Polyfill.io Supply Chain Attack: Malicious JavaScript Injection Puts Over 100k Websites At Risk

Polyfill.io helps web developers achieve cross-browser compatibility by automatically managing necessary polyfills. By adding a script tag to their HTML, developers can ensure that features like JavaScript functions, HTML5 elements, and various APIs work across different browsers. Originally...

VulnCheck KEV: CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code...

GHSA-3V33-3WMW-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

Polyfill[.]io Attack Impacts Over 380,000 Hosts, Including Major Companies

The supply chain attack targeting the widely-used Polyfill.io JavaScript library is broader in scope than previously thought, with new findings from Censys showing that over 380,000 hosts are embedding a polyfill script linking to the malicious domain as of July 2, 2024. This includes references ...

WordPress Word Balloon plugin <= 4.22.1 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Word Balloon versions = 4.22.1...

WordPress Magic Conversation For Gravity Forms plugin <= 3.0.96 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Magic Conversation For Gravity Forms versions = 3.0.96...

WordPress WPJAM Basic plugin <= 6.6.1.2 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin WPJAM Basic versions = 6.6.1.2...

WordPress Contact Form 7 Multi-Step Addon plugin <= 1.0.5 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Contact Form 7 Multi-Step Addon versions = 1.0.5...