MAL-2025-1382 Malicious code in vidio-kmm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e504408eb9deb6119908874c0e0d1a2ed179bfe908a21a8f42d8296ede12dbc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1381 Malicious code in ts-plugin-file-path-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a29c99a3decf55fe58b9d10ce858b903ae55f7d999f98549a8416b4c12352e65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gestalt-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edc35868180fe5879113537fbdce9118cb06ace84a31d55fa9268d5bc050091e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1373 Malicious code in pages-e2e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8fdc9ed5e9c2f9d6d0e57ed2a060d76ead69858fcbae60c4265500ef4dd1527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pmmmwh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61153050710afa63f182defea4220d45b2a3d6a8aaf0c059d892d9deee856b6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1361 Malicious code in fontsource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75a000a9d03b24e4668d3039226081176ee3e9d6488d0bfb2fc7dfceb1b05e63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1372 Malicious code in osae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a2bd262915382cb128bb666e68b026eba1833defef6743b4def27e204a71d74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1366 Malicious code in holahackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c18612fa91dc861c71f725e798c3acc7560a3f7735d2ec1291c3d90eec1f487f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1378 Malicious code in solana-web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae0ba85746959ae8f7ae3dc7a934de9e4cb299669dbb270322fa2d8871fd8326 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1369 Malicious code in node-tg-bot-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7691b80bd73d248d18ca3ab676ebf09d22c6e9702f8e80ec44aa70b3ce3ec020 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in openbet-player-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11f880dc4e1451453507ea3db6a2cf42a292a1e81dfd3df5bed7a77d00bb84a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1370 Malicious code in openbet-player-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11f880dc4e1451453507ea3db6a2cf42a292a1e81dfd3df5bed7a77d00bb84a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uzx-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7250eab0a6f8a7fb2b339d8b38fdfeacce4a669afd92b62c4f271d460973faf Any computer that has this package install...

Malicious code in gemini-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcb67009761d760d10c90b8b5ad828df5d94924a1595158c9007254e4b755d60 Any computer that has this package install...

Malicious code in lbank-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 478503c4a1ca3df17a3afbdbb8c6cf693d2a76bfba2dc8a30d55a86eb1ac0b19 Any computer that has this package install...

Malicious code in lbank-production (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6275383c66ccd00b519d197e703c4fa9ccd9985cb51b5cb1332911bdcfcb1e7e Any computer that has this package install...

Malicious code in probit-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fda95aa29510bdadd84f77f4192894a8b7ba7729b1fa65823a21672fc9e7674 Any computer that has this package install...

Insertion of Sensitive Information into Log File

Overview ray is an A system for parallel and distributed Python that unifies the ML ecosystem. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as ...

360 Product Rotation <= 1.5.8 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. http://example.com/wp-content/plugins/360-product-rotation/includes/iframe.php?licenseid=1"ale...

MAL-2025-1267 Malicious code in internallib_v789 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ef96477214541474a78705d81d93f2cee8bfdff72d03bc45f30c6431bacfb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...