MAL-2025-48579 Malicious code in mtls-ambassador (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7751747bc3d849e8a9b44fe993f8e2e3a5779f8c940573453433084eb4d3a07b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48571 Malicious code in mender-conductor-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a94fd07c8d4a77f846cebefc65582f689ea864796af0d0cbff8241f82d31a97e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mender-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95b2a0aeb7e210157ad59facfa9c0e679873c34a71078e93e3410440365970a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48561 Malicious code in deployments-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ba6d5d2de9ef4fd28b80daa2474015f2574ae70d3ccb9ea5c41c73c2f846bda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48560 Malicious code in create-artifact-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17addb465b6ed297d01361f4bf1b6b46f5eb2917622ac0f7b577dae8e7c29cae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-artifact-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17addb465b6ed297d01361f4bf1b6b46f5eb2917622ac0f7b577dae8e7c29cae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deviceauth-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81241adb2806e1b1d4e82b160d92edbdbec9ad3e8ba91dab321514de1f14fa75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48554 Malicious code in js-repack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a80a1c4ce3e508e53f6fbcff1d53486d344d5e88efb691abaad37cc22759f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-awesomefont (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85ee9e62f66e09344e931a1854ac52622771856fda95ece5f148374cc50b406b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-H773-7GF7-9M2X NeuVector is shipping cryptographic material into its binary

Impact NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data. In the patched version, NeuVector leverages the Kubernetes secre...

MAL-2025-48540 Malicious code in @jd-org/clear-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6d11360da81f86749d64e1c01171518474b7c636f9f729440f0a79dd1608e37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48536 Malicious code in reactify-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33fa7e90d4152416b1c914f2f869a4b26ea6afb25a672834b497be10bcea138a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48537 Malicious code in tailwindcss-setremotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6c0febf006b7df82465523db849fefa589b2b2f0a170de7d93ec856c729de2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48534 Malicious code in internallib_v808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdc267dc80d71e5150428ae279537b44916538d5b6e8d47b236ee01902ef1516 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-43270

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.4.7 Description NeuVector utilized a hard-coded cryptographic key within its source code. During compilation, this key was replaced with a secret key and used to encrypt sensitive configurations when stored. The...

Malicious code in hari-zzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81362ae48dc13755d39b24433b10aae444d143cf59e5e9a66a68f303fb5bfe7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stram-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 436c6121e283f5f6356fb575e1569411bd6123e6621dba3acec5df01273b5f70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48435 Malicious code in pino-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c35f1cee310ba73ad606845b7bf6d537b00db69bb318d6adf7b816b35d3d5690 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deficonnect-private-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26fd8af3107a958bc5c4f36594967520138fa3593b48322649201cec725af371 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in curve-ui-kit-security-notice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fb2012407c0ff7c7e2c1a915c8ad608d1b47a31f725b9a9e68d652ad55bfcc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...