WS-2019-0454

All versions of my-very-own-package contain malicious code. The package sends the output of process.versions, process.arch and process.platform to a remote server in a postinstall script...

WS-2019-0448

maybemaliciouspackage v1.0.0-v1.0.1 contain malicious code. The package prints the system's SSH keys to the console as a postinstall script...

WS-2019-0444

Version 1.0.0 of logsymbles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0443

Version 1.0.0 of log-symboles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0441

kraken-api v0.1.8 contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands...

WS-2019-0436

All versions of jquerz contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0433

Harmlesspackage version 0.0.1 contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server...

WS-2019-0429

All versions of froever contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor...

CVE-2026-6174 CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter

The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

WS-2020-0061

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM...

WS-2019-0417

Donotinstallthis malicious package contains a script that runs as part of the install script. The script contacts a remote service that tracks how many installations were done...

WS-2019-0411

colro-name contains a malicious code as a preinstall script. The package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0410

colour-string contains a malicious code as a preinstall script. The package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0406

cage-js contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script...

WS-2019-0387

Anarchy is a malicious package that runs "rm - rf /" as an install script which will clear everything on your root partition...

WS-2019-0380

8.9.4 is a malicious package which runs a dangerous code as a preinstall script and reads the system's SSH keys but does not upload it to a remote server...

CVE-2026-6252

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-3694 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the btbbbutton shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WS-2019-0132

ids-enterprise has a Cross-Site Scripting vulnerability in versions before 4.18.2 due to not encode Script tags in the soho-autocomplete component...

CVE-2026-5361

The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the updategallerydata function and improper output escaping in the galleryinit function. The...