Malicious code in cs-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2190818daf8cbe7ca369cf5eb1bcb74bdd542a4295ee61af7c6ef4617bf0ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in csbvue-unplugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a38a2c4f98b5c283b610975859aeaf5532b27f3b8d65ffb2f139275d91260dc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cschokidar-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63b18ad7ad67180b5b30bfcc6fbd86867deceb52cc2496442410bbd40f278241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cscchalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66587f2f6462d9fe615b5a03d13cfd464722cf0427aeb9392e4006f6d442d66a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1193 Malicious code in vue-plugin-rely-cs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c55de31ae355d3d408d5fa428b5cfb2eca66005c92cf6e397da4a4f29a5cdd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1086 Malicious code in cs-icons-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bf6991c8217c461988208239682ccf9c3ea1b42f51a0d382a8360308e951a43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cs-croppers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b5fe2d0f50b34b5c7b52305a30d84fda3ce6cc50b495da706b77ba41b3de0a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cs-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 481dd64f1bb368951028f0c7cb211c53754e51217edc6a8d89a31e8c9cc8ad9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discordjs-webclients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 168188008eac5d6566ff9dd1929ae45ef01c19a0f325ab680beb22b609aa1f5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1176 Malicious code in socketdinacom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4459df3f96084582c2521387c98e79539d5c8292c2cd1834447782864728aabd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1073 Malicious code in chialisp-lsp-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6dd3d79d6053db1cd153f11977e45ca5dabfc1ed73e22a68e807ce879e5be59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1062 Malicious code in aptos-cctp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b6cd02da8fc37ab7c63f1d8889bff2a948798c518d8d3ba61554aacbfa61546 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in world-id-cloud-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d426aafebc49ece5e901783812aae442cd394ad918b10e797b1fc10f9e56d0f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1170 Malicious code in pulumi-automation-sdk-ssh-tunnel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffa176b4dcf4483a947e659d4d4855bd174744d67a8ed98dadb4ddd425e41ea6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-ARGO-CD-2025-23216 Argo CD does not scrub secret values from patch errors

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

Malicious code in updatelanguagefiles (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e1b9ae3abf11e4ba584029f8f63912bd6afc637f8d6d6c0ee5ff4f1698b1610 Any computer that has this package installed or running should be considered...

Malicious code in momnet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db49a6a7ccd97fb305c1f35bd000db30977e139b1b9007a4e71975ee27b7b85d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-2960 · Easyvirt · Easyvirt Dcscope

Name of the Vulnerable Software and Affected Versions: EasyVirt DCScope versions 8.6.0 and earlier CO2Scope versions 1.3.0 and earlier Description: The issue allows remote attackers to generate JSON Web Tokens JWTs for privilege escalation due to a weak JWT secret. The HMAC secret used for...

CVE-2025-23216

A vulnerability was found in Argo CD where secret values can be exposed in error messages when an invalid Kubernetes Secret resource is synced from a repository. An attacker must have write access to the repository and any user with read access can view the exposed data. Mitigation Mitigation for...

Argo CD does not scrub secret values from patch errors

Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally o...