MAL-2025-191464 Malicious code in mayhem-wma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d242ed0467287371909e2fef415c86d7688c77b9a33f6b43c52d37bfc2d7fa6e The package mayhem-wma was found to contain malicious code. Source: ghsa-malware 9f00d5cfad9006d0cb83e7249554304291a746a42a2191314e1b70990e854df5 Any...

Malicious code in rpc-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca28ab1eabeac24c0ce55063ac151338d0255fcc2c8f74909566c8c3a3a8b1f The package rpc-validator was found to contain malicious code. Source: ghsa-malware 318ca2489ffa297599695ecb6b29c76c63bb61b59d5380b1092213774438e35d...

Malicious Package

Overview mayhem-wma is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2025-191463 Malicious code in initial-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bdfbaf17e5ea42f67e6327f5dfe8766f8a5f8d83fb4b390fc8d780da5555187 The package initial-path was found to contain malicious code. Source: ghsa-malware 014c829694ccb06463ad706603727d070cbf38be1e103200b54c1235ccc82611 A...

xorg: xwayland: Use-after-free in Xkb client resource removal

A flaw was discovered in the X.Org X server’s X Keyboard Xkb extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected...

Important: Red Hat Security Advisory: tigervnc security update

An update for tigervnc is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Low: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Malicious Package

Overview @vleo-dev/a11y-js-service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-191175 Malicious code in @accordproject/concerto-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d208898af793502494e9b8d4eaa5f6964e2ff49ff7fd50ca8dff9e9e40191313 The package @accordproject/concerto-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @browserbasehq/director-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b86bd8a3bb8b027a0b305fca0e5616b1f8cfee1229e47609ef43a14edb2ad0c6 The package @browserbasehq/director-ai was found to contain malicious code. Source: ghsa-malware...

Malicious code in @clausehq/flows-step-httprequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126cc191c92f3dd4eb7a0c64301c3d7e0ff5d999596b4c1b3584e38f130495cc The package @clausehq/flows-step-httprequest was found to contain malicious code. Source: ghsa-malware...

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin unauthorized data modification vulnerability (CNVD-2025-30131)

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin is a helpdesk and customer work order system plugin for WordPress websites designed to help businesses or individuals efficiently manage customer support requests. WordPress ELEX WordPress HelpDesk & Customer Ticketing System...

@actbase/react-native-fast-image contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

RHEL 8 : tigervnc (RHSA-2025:22077)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22077 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

@actbase/react-native-naver-login contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

kernel security update

5.14.0-611.9.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 248176...

@actbase/react-absolute contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

MAL-2025-191246 Malicious code in @micado-digital/stadtmarketing-kufstein-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b458f23284c11d0533df6f7d474554467329282fb52e761f0a654ef8cf69f3e The package @micado-digital/stadtmarketing-kufstein-external was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191456 Malicious code in @medusajs/analytics-posthog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4bcda5a08e7631f3c8bdbfd1c6a827a23b4a2cadf1ca3ca3a1ae32674df5172 The package @medusajs/analytics-posthog was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191411 Malicious code in quickswap-token-lists (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0934c2b16a82e9886cc6939348bffcb3b75d536fceac933cf1f38bbf9ffdbd05 The package quickswap-token-lists was found to contain malicious code. Source: ghsa-malware...