MAL-2025-5385 Malicious code in core_block (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abec18e0e968ed67b5d8b1b959a5d9da2c3cfea29f9bd1ac711c0a2fe70d83de Any computer that has this package installed or running should be considered...

MAL-2025-5260 Malicious code in demo-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7efb62b6588eae7ef14f94a8669af77aca640e90b4677dfcddbba8cce6ad547 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in demo-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7efb62b6588eae7ef14f94a8669af77aca640e90b4677dfcddbba8cce6ad547 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5458 Malicious code in sap.ushell.components.tiles.utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c610571a96a422fc7b583bd55f4996dc51b894fe4d4a8cf415f7ebf1be5caf7 Any computer that has this package installed or running should be considered...

MAL-2025-5459 Malicious code in secure-r007k17 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbd04d692c36ca50563b6dbb1de8053730817b3f74b9e23389dd90505621062a Any computer that has this package installed or running should be considered...

MAL-2025-5425 Malicious code in jun-xss-payload (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcb0bad0a9a4d062fb4b4b42ac803616eb78ce2cee23746dfc3636d0909ee918 Any computer that has this package installed or running should be considered...

PrivacyGo: Privacy-Preserving Ad Measurement with Multidimensional Intersection

This paper tackles the challenging and practical problem of multi-identifier private user profile matching for privacy-preserving ad measurement, a cornerstone of modern advertising analytics. We introduce a comprehensive cryptographic framework leveraging reversed Oblivious Pseudorandom Function...

MAL-2025-5255 Malicious code in acme-analytics (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 881763cab42ba018d4aa4b5c72fd9e6557ac88c0e0628608eb0c04c46de7e3cd Any computer that has this package installed or running should be considered...

MAL-2025-5477 Malicious code in web-experience-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2573a173de899b4418c487db0925ec6d4bc915254dbacc39c55f266604d652dd Any computer that has this package installed or running should be considered...

MAL-2025-5245 Malicious code in @monorepo-lens/pnpm-collector (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67c6ea5bbdbe7b178435d3ad215c7b7a36c72b9a0850c6f074da4f085d90e5cd Any computer that has this package installed or running should be considered...

Generation of Predictable Numbers or Identifiers

Overview Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers via the toBuffer function. An attacker can predict cryptographic keys that were generated using Uint8Array inputs on affected Node.js versions, leading to compromised security of derived...

Generation of Predictable Numbers or Identifiers

Overview Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers via the pbkdf2Sync method. An attacker can obtain predictable or uninitialized memory as a cryptographic key when key derivation is used with unsupported or non-normalized algorithm names...

Malicious code in react-smooth-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7510dd029031b29ab209e3114deb48a7ad72b83c7d10073376637b71e89abf7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5228 Malicious code in integromat-udt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb547f8f18d38d6961a510a598d8741dcd0baf2f8218a0bb5ed899fb606c35ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in art19-web-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 833f7a38c823fdd26727d7a6aec9c75365b96860e4723badca46db54163128da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5238 Malicious code in websdk-colours (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 525b4f90e12d0654f3383e01859016dab00f6bbab39b2d38eeb165bb8f09b63e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5220 Malicious code in applinks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c927df7579cbb8f129291c2b42746cc225d15855b821f735300d1773cbee4e5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5221 Malicious code in art19-web-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 833f7a38c823fdd26727d7a6aec9c75365b96860e4723badca46db54163128da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nf-cl-logger-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f9af3e16698ffb1e46af4d45f8b046c0ac49c6e277db7b769a831468aa92894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5233 Malicious code in nitro-contracts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcfdc095311c01986f57ec3730d8e3600f3c83ffb5fc23c500a51eed38ea048d Any computer that has this package installed or running should be considered...