MAL-2025-7130 Malicious code in @cobalt-marketplace/react-stateful-button (npm)

The package @cobalt-marketplace/react-stateful-button was found to contain malicious code...

MAL-2025-34706 Malicious code in tencentcloud-cos-sdk-react-native (npm)

The package tencentcloud-cos-sdk-react-native was found to contain malicious code...

MAL-2025-23707 Malicious code in jcatalog-react-reference-search (npm)

The package jcatalog-react-reference-search was found to contain malicious code...

MAL-2025-13812 Malicious code in @zalastax/nolb-react-tq (npm)

The package @zalastax/nolb-react-tq was found to contain malicious code...

MAL-2025-13824 Malicious code in @zalastax/nolb-react-u5 (npm)

The package @zalastax/nolb-react-u5 was found to contain malicious code...

Malicious code in react-y-pills (npm)

The package react-y-pills was found to contain malicious code...

Malicious code in react-pdd-msg (npm)

The package react-pdd-msg was found to contain malicious code...

Malicious code in react-pdd-calendar (npm)

The package react-pdd-calendar was found to contain malicious code...

Malicious code in @zalastax/nolb-react-ip (npm)

The package @zalastax/nolb-react-ip was found to contain malicious code...

Malicious code in @zalastax/nolb-react-uy (npm)

The package @zalastax/nolb-react-uy was found to contain malicious code...

MAL-2025-13806 Malicious code in @zalastax/nolb-react-ti (npm)

The package @zalastax/nolb-react-ti was found to contain malicious code...

MAL-2025-31842 Malicious code in react-pdd-modal (npm)

The package react-pdd-modal was found to contain malicious code...

my-first-vue-project (0.1.0), react-responsive-data-table (>=1.0.0, <=1.0.5) potentially affected by unknown CVE via bootstrap4 (0.0.1-security)

bootstrap4 NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on bootstrap4 and may be impacted: - my-first-vue-project 0.1.0 - react-responsive-data-table =1.0.0, =1.0.5 Source cves: unknown CVE Source advisory: OSV:MAL-2025-15992...

MAL-2025-6821 Malicious code in @tradair-repo/sources-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4c2e8efcfd67964d523b508359644439a1c57011cf171ba350241c6949654fe4 The OpenSSF Package Analysis project identified '@tradair-repo/sources-react' @ 1.0.0-malicious npm as malicious. It is considered malicious...

CVE-2025-55008

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by...

Malicious code in eslint-plugin-react_editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 091ef657bc115b400dc3d8cd65691df53caef85fa307f52d627aac4d50120a77 The OpenSSF Package Analysis project identified 'eslint-plugin-reacteditor' @ 71.71.72 npm as malicious. It is considered malicious because: - T...

MAL-2025-6812 Malicious code in eslint-plugin-react_editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 091ef657bc115b400dc3d8cd65691df53caef85fa307f52d627aac4d50120a77 The OpenSSF Package Analysis project identified 'eslint-plugin-reacteditor' @ 71.71.72 npm as malicious. It is considered malicious because: - T...

CVE-2025-55008

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by...

Information Exposure

Overview @workos-inc/authkit-react-router is an Authentication and session helpers for using WorkOS & AuthKit with React Router 7+ Affected versions of this package are vulnerable to Information Exposure via the accessToken and sealedSession parameters in the authkitLoader function. An attacker c...

CVE-2025-55008

CVE-2025-55008 affects the AuthKit React Router library for React Router 7+. In versions ≤ 0.6.1, the package exposes sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader , causing them to be rendered into browser HTML (informa...