Malicious code in mstate-react (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 997c10662d47fa55ca8cd4db612274bf4d589c7d82d079b48fae3261bb5c65a7 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @nexe/config-manager (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22a78a7d10a59f7a2928448f3166f83de5443650d498bd687751f36688e87c5d Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47320 Malicious code in jumpgate (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97bb9f6eba8030517cfb22f10da2b5f5d7b4c04faa1168e2fb713c030b3f7b95 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47258 Malicious code in @operato/input (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75dee2f83ca97ee20521cbc286afa17f03f25de817877fe1f41b47885531878a Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47375 Malicious code in @art-ws/di (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5893f906a9509ba9c661d363a4cc1883e4e38ca444f1941ee7e81c6e551df0e9 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @things-factory/shell (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ebd494f09184269de61b62501f8b32bfc56c353807f7e7356cecc35c5ab1346 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @art-ws/di-node (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b394dcc54d336ef0ffabaf044cf0713eb4d4ffb075cc32163ad8d19967474aba Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @hestjs/validation (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bab13770d435b4c72400820835bbae6df2dcd23b814256d0db636acb1e82167 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47281 Malicious code in @thangved/callback-window (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed460a227837fd3f7ae156229624e47d46e10b4bca19f0089a29f75c5ca13e09 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47385 Malicious code in @art-ws/web-app (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e62980b203a34306053bc41b9a7afd7d7b061fe6751f1e7bf037f85496995e2 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47286 Malicious code in @tnf-dev/js (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 292d245c3ca4d0fdd82283650bae7b8c7da1f843e984906c10402454c065daec Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47301 Malicious code in cordova-plugin-voxeet2 (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96ae7ef5d43ef45901a8613d236559761bb72ca1729594ffc8b3df8200250094 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in tvi-cli (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f78946397af9b739b00884d97f406ea16405f5558af770d05400083fd26e7061 Any computer that has this package installed or running should be considered fully compromised. All...

CVE-2025-4953

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files...

CVE-2025-55111

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating ...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious code in @crowdstrike/glide-core (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c50fb4842e12feb703463f76e42b30788a613940789be0e353b396b7de4cba8 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47233 Malicious code in @crowdstrike/commitlint (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e58c63ca78f39890835120723ac0ab398dbaddb3018f3b640145685ab38cdd93 Any computer that has this package installed or running should be considered fully compromised. All...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

MAL-2025-47321 Malicious code in keithowan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e907b68179fa9c3d3d6cbb97df4bfd9ca6cc4f833affd757ae94b58c1a7d65c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...