MAL-2025-18251 Malicious code in delta-tree-quick-xi-rho (npm)

The package delta-tree-quick-xi-rho was found to contain malicious code...

Malicious code in error-iota-file-quick-shell (npm)

The package error-iota-file-quick-shell was found to contain malicious code...

MAL-2025-39768 Malicious code in xi-web-data-water-quick (npm)

The package xi-web-data-water-quick was found to contain malicious code...

MAL-2025-40204 Malicious code in yaml-psi-tau-void-quick (npm)

The package yaml-psi-tau-void-quick was found to contain malicious code...

MAL-2025-36837 Malicious code in thread-reject-runtime-quick-rain (npm)

The package thread-reject-runtime-quick-rain was found to contain malicious code...

MAL-2025-32043 Malicious code in reject-uglify-phi-xml-quick (npm)

The package reject-uglify-phi-xml-quick was found to contain malicious code...

MAL-2025-24939 Malicious code in lambda-fast-yaml-quick-virtualize (npm)

The package lambda-fast-yaml-quick-virtualize was found to contain malicious code...

Malicious code in thread-reject-runtime-quick-rain (npm)

The package thread-reject-runtime-quick-rain was found to contain malicious code...

MAL-2025-34105 Malicious code in stub-cat-good-quick-sigma (npm)

The package stub-cat-good-quick-sigma was found to contain malicious code...

MAL-2025-31294 Malicious code in quick-code-balance-spy-java (npm)

The package quick-code-balance-spy-java was found to contain malicious code...

MAL-2025-18307 Malicious code in deserialize-slow-warn-quick-export (npm)

The package deserialize-slow-warn-quick-export was found to contain malicious code...

MAL-2025-31297 Malicious code in quick-start_onnxruntime-node (npm)

The package quick-startonnxruntime-node was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-19795 Malicious code in error-iota-file-quick-shell (npm)

The package error-iota-file-quick-shell was found to contain malicious code...

A week in security (August 4 – August 10)

Last week on Malwarebytes Labs: Adult sites trick users into Liking Facebook posts using a clickjack Trojan Facebook users targeted in ‘login’ phish TeaOnHer, the male version of Tea, is leaking personal information on its users too How Google, Adidas, and more were breached in a Salesforce scam...

No QUIC certificate pinning with wolfSSL

...

UBUNTU-CVE-2025-54145

The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability affects Firefox for iOS 141...

CVE-2025-5818: Server-Side Request Forgery (SSRF)

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

CVE-2025-1729

A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privileges...

CVE-2025-1729

A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privileges...

CVE-2025-1729

CVE-2025-1729 affects Lenovo TrackPoint Quick Menu (TPQMAssistant.exe). A DLL hijacking flaw allows a local attacker to escalate privileges by placing a malicious hostfxr.dll in the TPQM directory where the binary is launched; the TPQM folder is writable by standard users, enabling this. The issu...