Storybook manager bundle may expose environment variables during build

On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks. The vulnerability is a bug in how Storybook handles environment variables defined in a .env file, which could, in specific circumstances, le...

BIT-PARSE-2025-67727 Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which...

CVE-2025-68429

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a .env file, which could...

CVE-2025-68429 Storybook manager bundle may expose environment variables during build

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a .env file, which could...

CVE-2025-68429 Storybook manager bundle may expose environment variables during build

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a .env file, which could...

CVE-2025-68429

This CVE (CVE-2025-68429) affects Storybook builds where environment variables in a .env file could be unintentionally bundled into the web-facing build artifacts. Vulnerable if you run storybook build in a directory containing .env (including .env.local) and then publish the built bundle. Affect...

Malicious code in vitor-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bd6760c1b98479c10035033bae4ed585e80c762bf7fd4c79d45bdc990a852e The package vitor-js was found to contain malicious code. Source: ghsa-malware 59962d3857dd8e503c596b43fbb33337d27bea7c1f53e69a305e690913599163 Any...

MAL-2025-192603 Malicious code in vitor-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bd6760c1b98479c10035033bae4ed585e80c762bf7fd4c79d45bdc990a852e The package vitor-js was found to contain malicious code. Source: ghsa-malware 59962d3857dd8e503c596b43fbb33337d27bea7c1f53e69a305e690913599163 Any...

MAL-2025-192602 Malicious code in plugin-senna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44b28e2a98490c65ae2fbece390c2a69e10ce7635599d405977501ee25277e The package plugin-senna was found to contain malicious code. Source: ghsa-malware d7aaf417fb3dc9c862b43e668d1946f17795e33cfe873f11db2d309776b93b06 A...

Malicious code in plugin-senna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44b28e2a98490c65ae2fbece390c2a69e10ce7635599d405977501ee25277e The package plugin-senna was found to contain malicious code. Source: ghsa-malware d7aaf417fb3dc9c862b43e668d1946f17795e33cfe873f11db2d309776b93b06 A...

CVE-2025-68284

CVE-2025-68284 concerns the Linux kernel, specifically the libceph authentication path in handle_auth_session_key(). The issue arises from the len field originating from untrusted network packets, enabling potential out-of-bounds writes during decryption of the connection secret or during process...

Malicious code in tailwind-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50a9b7a9c02e83e0b4145dc9caaa9d04b407a199ae5d54b9f544f91397980966 The package tailwind-variables was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwind-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c71a662da2f505a840efadd0fae8fc82d44fe869c688fc1a5f4b7bf4d0a517 The package tailwind-stylecss was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192600 Malicious code in tailwind-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50a9b7a9c02e83e0b4145dc9caaa9d04b407a199ae5d54b9f544f91397980966 The package tailwind-variables was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192599 Malicious code in tailwind-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c71a662da2f505a840efadd0fae8fc82d44fe869c688fc1a5f4b7bf4d0a517 The package tailwind-stylecss was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192598 Malicious code in bigmathlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e535ed570f999285684c4f2a79ce262d460a98329790e34f433542070b9298 The package bigmathlib was found to contain malicious code. Source: ghsa-malware d73c91abd6a323d119e598928fc613100786424177806e36bb5ebd15f666de3e Any...

Malicious code in bigmathlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e535ed570f999285684c4f2a79ce262d460a98329790e34f433542070b9298 The package bigmathlib was found to contain malicious code. Source: ghsa-malware d73c91abd6a323d119e598928fc613100786424177806e36bb5ebd15f666de3e Any...

Malicious code in openhands-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3094854e6f43f64c218e6ccdf21f319cff916fef4a412442faccf4b9cd616fe9 The package openhands-frontend was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192593 Malicious code in openhands-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3094854e6f43f64c218e6ccdf21f319cff916fef4a412442faccf4b9cd616fe9 The package openhands-frontend was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192586 Malicious code in dubbo-js-private-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7718e849fa01a112b317438650757b783681fbb3361ec73154005719f6f892 The package dubbo-js-private-workspace was found to contain malicious code. Source: ghsa-malware...