CVE-2025-24397

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins...

MAL-2025-331 Malicious code in another-depconf-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6876487b755ba50effc916826fdb407f0f653893569fef933deb61a21a8d6626 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in legacy_vis_analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28ff9d6e37ea3e8b2d1b4748cd469a912ac50750610b909bfcf67f1fdc42e720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in built-with-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f426ea9ad545f39f1e84cd26ee384b096d08c2b82f8b3554f97fc1ce85fac83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cschalk-next (npm)

This package exfiltrates API keys to an attacker-controlled server. It also has destructive functionality to delete development-related directories. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91aaf0d72370eff4321359a559af7a578a16bb5aeefeedd6ec52ae25b8297a21 Any...

Malicious code in cschalk (npm)

This package exfiltrates API keys to an attacker-controlled server. It also has destructive functionality to delete development-related directories. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bc84195226616b9037825439862309922afde77ccd32cc2c6158025030d27b2 Any...

Ex-CIA Analyst Pleads Guilty to Sharing Top-Secret Data with Unauthorized Parties

A former analyst working for the U.S. Central Intelligence Agency CIA pleaded guilty to transmitting top secret National Defense Information NDI to individuals who did not have the necessary authorization to receive it and attempted to cover up the activity. Asif William Rahman, 34, of Vienna, wa...

MAL-2025-312 Malicious code in site-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08f1194c6e49d7adf88a2a70415fcd789fab720cf63e7121963cff8fe1195fc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-302 Malicious code in request-external-access (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf57b443887e773384068e114f407f70b10c0278c6839c0d5c34f2ba575a63a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-293 Malicious code in domain-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14a682b54ff19305a641790fc1f96d99a5a4dab9277d7796627d1c34f6d80bac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dops-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7424d9aa8c2bde93f8112704428131dce54ddc6083fbc8eb880e289c3b1737e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-coin-btc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ae32f6f4577bb9bc54269aa0b6e1c46e849d1a36823c0cdea862d5eea40b5c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-291 Malicious code in design-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7a60ac481f3005406c24eaaf2970a7d6d349201ce49fed87277a9436b52bddc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-306 Malicious code in sdk-coin-avaxp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ee94cfa5a5aa6b22e135137520e3b26398c9d013a5405d3240f7b3948507005 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-268 Malicious code in aem-angular-editable-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fca4a582054bbff21e69768e3b5934e358df88c79f61073e65cf4272a8510544 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in calypso-babel-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b19b336747cffb6dcd17e2bdf7369eaeffb28fe85d0c8198710e89dbced26e94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in prem-babu-media (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccac29381b3bd14c6e4cb018f0bda417c6f15625becf906f6f965cf776b89570 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in prem-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc7dddf8406e12d71eea827bdcb666be7fbcff46abe825fbdfe7f315f250b680 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-226 Malicious code in prem-fb-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fbb6df275aa4fd3a58792cb72b230546beeaa2fe12aae5f63ed5d516907fdf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

A week in security (January 13 – January 19)

Last week on Malwarebytes Labs: iMessage text gets recipient to disable phishing protection so they can be phished The new rules for AI and encrypted messaging, with Mallory Knodel Lock and Code S06E01 Insurance company accused of using secret software to illegally collect and sell location data ...