MAL-2025-2381 Malicious code in epic-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d79b6f53b73a42bf490549818051758b4fafca55d32e9d85060712adfa1b5e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2406 Malicious code in reason-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0c4a55fcc5c8561afbb5e8b0657b735402db2afe7ac15858050352a3a8aa8c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-highcharts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b07952c4a78f4c462a288e6a648a238e98bc0232aa1e4bf6a0e5ad25bf3507 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2380 Malicious code in elementor-hello-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3dcf5dc0f88c313bcb767622f9a1e9e169099597b2e519c7c3df4bc25c8d799 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sheingroup/justakiss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcd17fcad0f2896dfc1a21c4b0e65d0db6a1deae574d2ee5f8a51b31309b3290 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sheingroup/loveshiro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 524a8945eaa3e9c0e35a456f440638f7568e971bf57dff30c9b6a4cd0be14714 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Post-Quantum Secure Feldman Verifiable Secret Sharing 安全漏洞

Post-Quantum Secure Feldman Verifiable Secret Sharing is a Verifiable Secret Sharing VSS for Post-Quantum Secure Feldman in Python by the individual developer David Osipov. A security vulnerability exists in Post-Quantum Secure Feldman Verifiable Secret Sharing 0.7.6b0 and earlier versions, which...

Post-Quantum Secure Feldman Verifiable Secret Sharing 安全漏洞

Post-Quantum Secure Feldman Verifiable Secret Sharing is a Verifiable Secret Sharing VSS for Post-Quantum Secure Feldman in Python by the individual developer David Osipov. A security vulnerability exists in Post-Quantum Secure Feldman Verifiable Secret Sharing 0.7.6b0 and earlier versions, which...

PT-2025-11328

Name of the Vulnerable Software and Affected Versions tj-actions/changed-files versions prior to 46.0.1 Description A supply chain attack targeted the tj-actions/changed-files GitHub Action, affecting over 23,000 repositories. A threat actor compromised a bot account's personal access token to...

VulnCheck KEV: CVE-2025-30066

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens PATs, npm...

CVE-2025-2079

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT JSON Web Token sessions...

CVE-2025-2079

CVE-2025-2079 affects Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool (v3.1.2rc11). Reported issue is a hard-coded secret key that could allow an attacker to generate valid JWT sessions, potentially bypassing authentication and gaining control over the tools. Pu...

CVE-2025-2079 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT JSON Web Token sessions...

CVE-2025-2079 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT JSON Web Token sessions...

GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad

Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...

Insertion Of Sensitive Information Into Log File

github.com/hashicorp/nomad is vulnerable to Insertion of Sensitive Information into Log File. The vulnerability is due to improper logging practices due to workload identity and client secret tokens being recorded in audit logs...

Malicious code in react-event-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7117f482ca3c7fec4102581d249b98a017fe0b05eb1dbc836070e0f0c8b245c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2296 Malicious code in array-empty-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9923e27ee77980880cfc13a3c78c4903c58bed58f9257ac0407d57841fcc7853 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2307 Malicious code in empty-array-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 349e81874005a4e4ed11f5e452324e817f3fc61d4a22f5237445d562df83fb60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hybrid-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac5872f7c58c6dc0aa16876689ec20891753358c36a7a1c35c223e3d3f9cf38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...