MAL-2025-47521 Malicious code in sha256-validation-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3290610bb31bf5689be7241b664ae5eb52b47b834fff3e2597c5ab75d88c4bec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iconfont-icons (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b7bb9c2f9da72d5f2921c8a1f5f168c03307649d8ed230ea031fde029d890c0 Any computer that has this package installed or running should be considered...

Malicious code in vite-plugin-parse-json (npm)

The package vite-plugin-parse-json was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4013d2b27a0c8568a2b51161431838d7877caf18d55e179597d06e162989b484 Any computer that has this package installed or running should be considered full...

Malicious code in fezbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ced7d3b77fec12a874f274f33a417e27bbf21e58f9dfe01e15c734c92286dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47507 Malicious code in vite-jsconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f03bb7808458e6fe8226e85f4870698a47c60f6b846bd9f95283b27800b215ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47501 Malicious code in tailwind-cup-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b63b6f29071fd3e01046c19dd01c0f863e62d3c2fd92a1f51d040e5f06ec839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47500 Malicious code in tailwind-computer-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fe2d038cea92762b28824efadea2c16ed3b4d33f8a9da09a6a3eece138fd159 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47497 Malicious code in some-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3558d5270ba6945f13c577df7f903f2e449b54435c6aa2ee46d721ef5e9ea198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47496 Malicious code in recharts-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c4ceccc5b595b8382c50ef249896ff0ebe9b299b3791bc7a7c5f90ec2f5481d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47491 Malicious code in postcss-calc-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a126d37fa7524804ef4c161588d71e9837418138fd67c7fbd8bc775d0f78a49f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @biorad-lsg-tsc/status-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f422d58b985c9678c5289e60b8db971d9755d69257a8d10c108ec85e37b6dfec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47475 Malicious code in cui-travel-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28f2686ec4318061b35e9018872a2a9f3a364c77dcf26ccc1bc405d36475d8fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-device-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113702b97f378bfde6af287d00821b1e3ebec6cfa164e3d263f57632210869c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-59339

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, i...

Malicious code in oauthly (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f51e9d4666c50bc7bc1a5f83811020d5da995fc251b9ec96a9ad3b8a3c6e2ecf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47469 Malicious code in internallib_v915 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3514c2a5f4c17fc8f3a153f8c5601c0308a3dded83b19b0b6a387943c2425178 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47449 Malicious code in another-shai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3fba9cc731c68608bf4548a514b4491220c23775767b250f6c1cc318584a843 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-59339 The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, i...

CVE-2025-59339

CVE-2025-59339 affects The Bastion’s session-recording workflow: the osh-encrypt-rsync script rotates and encrypts ttyrec files using GPG keys, but it silently fails to apply signatures even when signing is requested. This can undermine data integrity of archived ttyrec files. Affected component ...

CVE-2025-59339 The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, i...