Malicious code in cx-hub-interaction-ui-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a9bc1addddaee6ed4aa8352a5162c828bddcc53ddee490fb211f76247c23cd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-copack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57401915f2c34bc9f6acd6172ce514016093a6857148c0d46ef0bad52792c357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48256 Malicious code in mad-2.4.1.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56c6fc06b90e0e637cc8ef419f8a5844e909deaf9cc68f1c73e231757e6f214a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mad-3.0.0.2.2.8. (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f55ea64844c2d952af8c4418678dabfad5ee8b387cb2efacddea6fa25021240 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-61926

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...

CVE-2025-61926 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...

CVE-2025-61926

Allstar Reviewbot had an authentication bypass via a hard-coded webhook secret. In Allstar versions prior to 4.5, inbound webhook requests were validated against a secret embedded at compile time and not configurable at runtime, causing all deployments using the Reviewbot code path to share the s...

CVE-2025-61926 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...

CVE-2025-61926 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...

CVE-2025-35056

Newforma Info Exchange NIX '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the...

MAL-2025-48122 Malicious code in redirect-4r6ynv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41a7d6bfb0fbcf3836300c4c231865a31c603616b44b878f4a7a908af4183e0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48111 Malicious code in redirect-1st7z7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 638828fbe37e3987211d30f184858e313c2d97580599b67ec562cd00ce90d942 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-4r6ynv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41a7d6bfb0fbcf3836300c4c231865a31c603616b44b878f4a7a908af4183e0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-47cprv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 805fa2724922cd5611fa30b7edd9bbf19375b36b1d910e2e30a32bfcb07bbfdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-5iqds5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f36f3079f5a6efbec38e19190069056d7769ce95a36553812dd4283d624f09a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-fohapy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0c91babb7b418b4433ead89eedfc26e640d7d909cb242d8c641dc853a257e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-1p89nj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43688fce1f12de08acc0da78811aac96ec28e59b080c8cd03c83ca80c1b69bec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-vlgk2c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18734d591d60ae3710a881e043a5ff1706db08ea32339fa268acf9ca38baa372 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-sykre1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f296cb64fbc02775939f48a02ff61324d6099ed104e812a06f43ebea542989bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48193 Malicious code in redirect-n95xyv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 290840d73f97e45dd4bc9aa7b7b5111f4341e7c8db6b924ca7e6fb1f444c4aa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...