Malicious code in social-network-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89279e5bb7b18cd7f18b0018f976d1e055fbeb331245019a6c3e75796c3bf1e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4021 Malicious code in secure-data-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b4c358b5a571c99b8b2f4b94a39729183ea9d5498e9407722a73f366bacd2b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4023 Malicious code in skip-tot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6960890dc5d1f82009184b7fc7b4bded6fdf2a39d1423fd05abfba07bbf58862 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in os-info-checker-es6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7d48d1ef01f6c43c34237496128c5593e34836a51db6b931a38f9d1520562c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Gardener 输入验证错误漏洞

Gardener is an open source Kubernetes cluster management tool from Gardener Open Source. The product supports managing, monitoring and updating Kubernetes clusters. An input validation error vulnerability exists in Gardener versions prior to 1.119.0, which stems from bypassing project secret...

CVE-2025-47945

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-47945 Donetick Has Weak Default JWT Secret

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-47945

Donetick is an open‑source task/chores app. Before v0.1.44, it uses JWT authentication with a weak default signing secret, enabling potential full account takeover of any user. The live version confirms the issue. A patch is available in v0.1.44; recommended mitigation is upgrading to 0.1.44 or l...

Malicious code in blahblahblah-definitely-not-a-real-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2200fcdc37007fa010dea283e42096c6211571af64a48492a2fe0b550a39ac62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-21802 · Donetick · Donetick

Name of the Vulnerable Software and Affected Versions: Donetick versions prior to 0.1.44 Description: The issue concerns the use of JSON Web Tokens JWT for authentication in Donetick, an open-source task management application. Prior to version 0.1.44, the application uses a weak default signing...

Malicious code in yamoney-guidelines (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b70971cf40ad70b7bc7610b7db4903284da0bf3b36c7877d50385f6aa73cbf4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flipper-plugin-preferences (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72ed77743cfbbcc3b9082b68fd1ebbfc81e78c93b7b73d1045b70adae1785b8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3889 Malicious code in flipper-plugin-preferences (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72ed77743cfbbcc3b9082b68fd1ebbfc81e78c93b7b73d1045b70adae1785b8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flexible-loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ff06dde8fdb6c689a2645607380a7a1d837f2b3b3c16ba52c2bb6bc1ea69d34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3888 Malicious code in flexible-loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ff06dde8fdb6c689a2645607380a7a1d837f2b3b3c16ba52c2bb6bc1ea69d34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3887 Malicious code in feed-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37ecacad9f24ab5516c2aa28546214f1a2fa2f1156c02e06e9e9b8dc41365e8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3896 Malicious code in interaction-tracing-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bc44527be12ab239c8eb8888f44085af9473a67398c0a0ea70a465f7ac011e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3860 Malicious code in yandex-int (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d314fd1e5fe72ac326ff48b35eeea0675329a3035ad79569701b5e2b27c4e198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3806 Malicious code in @hotmart-org-ca/cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4248adb5119119c8a93c3615e413df74e456739391ebff8e89f978a212a0659 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in this-is-test-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42cc414b619b36e4c74b43260274d61dc8a3eba447bb95a4bb4bea65cc510722 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...