122382 matches found
MAL-2026-3741 Malicious code in pyexecutorsme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 326ad16be9056f6cbd75fa4f9a47dec8c3613b56aa53d3e5d439efeef7c6fcad Package attempts to download and execute a script acting as remote access trojan. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
WS-2012-0023
XSS injection vulnerability was found in loofah before 0.4.6. Loofah Gem for Ruby contains a flaw that allows a remote cross-site scripting XSS attack. This flaw exists because the Loofah::HTML::Document\text function passes properly sanitized user-supplied input to the Loofah::XssFoliate and...
CVE-2026-42457
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
WS-2020-0202
The package jdb.js contained malicious code. The package ran a postinstall script and contained a dropper for the njRAT/Bladabindi Remote Access Trojan...
WS-2020-0190
twilio-npm opened a reverse shell to a remote server as a postinstall script. Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The packa...
Nexus-Sonatype-Repository-Manager-Groovy-Script-RCE-Authenticated-
Nexus Repository Manager 3 Authenticated RCE Groovy Script Ta...
WS-2020-0176
Upon installation, the 'electorn' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...
WS-2020-0175
Upon installation, the 'loadyaml' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...
WS-2019-0488
Yeoman-genrator v1.0.0 contains malicious code as a preinstall script. The package is malware designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0482
All versions of uglyfi.js contains malicious code as a preinstall script. The package designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0481
All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking...
WS-2019-0461
versions v1.0.0--v1.0.4 of only-test-not-install contain malicious code. The package deletes the folder /test from the system as a postinstall script...
WS-2019-0454
All versions of my-very-own-package contain malicious code. The package sends the output of process.versions, process.arch and process.platform to a remote server in a postinstall script...
WS-2019-0448
maybemaliciouspackage v1.0.0-v1.0.1 contain malicious code. The package prints the system's SSH keys to the console as a postinstall script...
WS-2019-0444
Version 1.0.0 of logsymbles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0443
Version 1.0.0 of log-symboles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0441
kraken-api v0.1.8 contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands...
WS-2019-0436
All versions of jquerz contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...