Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview @ctrl/tinycolor is a small library for color manipulation and conversion Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Malicious code in copperflame (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa4bc59373e996ffbc13a99c552e80699ccbd913beff4bebb211e57f56093915 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47177 Malicious code in err-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0eafe58cdd2171d0209fa3bbc4150f186232cd35115cfb537dde7dd1842e98e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in texttweak-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 366586b816182bcde0c96a7b2ad0ba3388a1fb49629c3690d7d3c9e41f7b1dae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47205 Malicious code in str-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbae0fa7ec3f4325516d97436685965bc1ff6dddaf218710407f697497c579a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47174 Malicious code in basic-pump-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc10b9f2bba8789f982dedfa26ff72ba0c4149b11d522b1d60523fac65c58419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in basic-validator-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a065e2ce3dcaa4245e9bd8873e7878385dbe7a3fe9aa7276ae5ac89686209889 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47186 Malicious code in jsonstylizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 085d3b8a0491210bdcc534a63cbf29b4342b14a727d38e4bea0c8fae2f747dd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47185 Malicious code in jnscript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 061c827dba1805eb29a15f2ecb9cc870bbc52edca26282a7a42d392de950ef42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @huobi-lib/vulcan-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19abe7ab9afcd189bbbd5061add8629d1f576b8dae3944cc7974b7581ffbd570 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47179 Malicious code in eth-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e3bae1d6be9bca527622368d2a291d97b40692ce8996525eefb78917c7e0de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47178 Malicious code in eslints-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b662ef08a1f7e1997586aa84a90068921137be8ec4c4c82df2ba5c5318ad3202 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47211 Malicious code in tailwind-configs-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee3c791a92600ef66a7c4165e740bfeda8da8dad109a35e6db271d6fe07caf7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory (FEDORA-2025-c71f0af9b2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-59054

dstack is a software development kit SDK to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstack prior to 0.5.4, a malicious host may provide a crafted LUKS2 data volume to a dstack CVM for use as the /data mount. The guest will open t...

CVE-2025-59363

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...