Malicious code in 1libxmljs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabdd956b939ba7ecadbced1795cced1214b25b2faf5920d3dd1f80374b42390 The package 1libxmljs2 was found to contain malicious code. Source: ghsa-malware f356ae30a62d4d1611f89041412c4c86aadd5c438b5809c1d4ee201ee814ea26 Any...

Malicious code in workingstealer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e56b24eb6e9737f361dce6ec109a95d6329de8392f296067cdc01e7f6950ddd1 The package workingstealer was found to contain malicious code. Source: ghsa-malware a5fb745fd37fc6048377cf7a40be4da1bf4751d412c4601909747d7b4ee38bb0...

Malicious code in chai-type (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dd763492f1ac2f8cf3da33f830d95eb7ea1b0a3c2e2fc03e9b0038dfce25e5c The package chai-type was found to contain malicious code. Source: ghsa-malware a6490275a9d6876c496fa488086d17c0ec0329c4f5f94ee6c061c50fe95c89b1 Any...

MAL-2025-190551 Malicious code in node-calculator-36ae (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51dc4c4001b55763ab48a478aec316bdcd431278c7123df65befe745b23e6d1b The package node-calculator-36ae was found to contain malicious code. Source: ghsa-malware...

Malicious code in integrator-2829 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bcecff983d9f430d14498333405f44d090846f460508f71de76679fb2076e9 The package integrator-2829 was found to contain malicious code. Source: ghsa-malware e38f5e4a7250f8d8199f26a59e70750071a304fc729893e38b7074a1cd3ab50...

Malicious code in signals-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83d5dc4270646b6f83ba4c0f5f334ec8a5cedd7b16888c9b51a7b3159ddd32ce The package signals-embed was found to contain malicious code. Source: ghsa-malware 9a80ff00c3aa6ab32518f57107ea588aa2da22e76d6db9823783032b89ca146f...

Malicious code in integrator-2830 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115be0b5028ffab5a29306a2d2d83f0f5f3dc669567f3e0615c37a1d3ebb6181 The package integrator-2830 was found to contain malicious code. Source: ghsa-malware a63fa08d4b3a438ab307f36f34faddc4f6d7f1fa928c42c3ae3318e3384748b...

Malicious code in application-phskck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6943455b71ad210483f41c6aad1617346d5cf05804711e7d3c08a94cd5d35084 The package application-phskck was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190502 Malicious code in application-phskck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6943455b71ad210483f41c6aad1617346d5cf05804711e7d3c08a94cd5d35084 The package application-phskck was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190509 Malicious code in react-confetti-modern (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97a195b8307abbf7a2b6a5d4bd82b65aaad0891e87788e11d1a934707180631c The package react-confetti-modern was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190501 Malicious code in tailwind-styled-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac987129deefb5aef175dc25c742373acfa189bdb1511017f6fff95a99e9ceb9 The package tailwind-styled-scrollbar was found to contain malicious code. Source: ghsa-malware...

Flowise Fails to Invalidate Existing Sessions After Password Changes

Summary Failure to Invalidate Existing Sessions After Password Change Persistent Session / Session Invalidity Failure. Details After a user changes their password, the application does not invalidate other active sessions or session tokens that were established before the change. An attacker who...

GHSA-X7RP-QJ2H-GHGW Flowise Fails to Invalidate Existing Sessions After Password Changes

Summary Failure to Invalidate Existing Sessions After Password Change Persistent Session / Session Invalidity Failure. Details After a user changes their password, the application does not invalidate other active sessions or session tokens that were established before the change. An attacker who...

Malicious code in chain-test-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3e0c036eeb1631fbe88e6fc1c18dc89f31a900e1d528bd2027a2aef1eb35a60 The package chain-test-async was found to contain malicious code. Source: ghsa-malware c1d03d8b6de88ac68ebdd7ea00a039ed4f3d071cda41ca8e038c5cad8eb212...

Malicious code in vite-chunk-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa857f9f07f371efc55f392a0fcf81beea9480a42476b38fe80cf496b37ba8d The package vite-chunk-master was found to contain malicious code. Source: ghsa-malware...

MAL-2025-154673 Malicious code in dioago-kamo-ala (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3371a361974d6baba10d18340abf8a98d2837a7f942f44f9a6d52fee3b0f083f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-cygnus-sync-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83ce14a4ddd7e7d11d764543dc23faf3d5934fb6001941a7c607b55b5975b389 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146019 Malicious code in pegasus-callback-build-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa451bc61732e3800480939f0e2c59aacea12ed0549347ad33424411dbe39b55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-98722 Malicious code in frantic_slug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c904b9ebcda8835c3296a759911689c3207d8550a4c0ca63a8b9fd5e3fc7c9ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76659 Malicious code in rulesdir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c805fe99761f008f2684b4317d760d59a99462becf37b554d6673444045ae3fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...