PT-2026-64840

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

Malware in feishu-qrcode-login

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in feishu-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e20a20734f8fdc2d03dc6bcd76d255f620ab53a1a2e708ebe34e4e16237c491a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5556 Malicious code in qq-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dc5a231da669d82038a77d061637b848b5258d7598c0ffe30c1e13612d3b68c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qq-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dc5a231da669d82038a77d061637b848b5258d7598c0ffe30c1e13612d3b68c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in qq-qrcode-login

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...