Karmada Dashboard API Unauthorized Access Vulnerability

Impact This is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints e.g., /api/v1/secret, /api/v1/service did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Althoug...

MAL-2025-48596 Malicious code in react-alerts-template-basic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea74fdb0b572b194c03927e7ed2eb81658a849eb093b395f77d6b74db3b1d7ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-alerts-template-basic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea74fdb0b572b194c03927e7ed2eb81658a849eb093b395f77d6b74db3b1d7ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48595 Malicious code in glowmotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 689f84ac7556578ba4404c09552cd9f86ea81c1dabe28dcfdc613fa4ac233285 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in glowmotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 689f84ac7556578ba4404c09552cd9f86ea81c1dabe28dcfdc613fa4ac233285 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48597 Malicious code in shadeforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7eea02ef501299fe8810df8e336242386a2ed75d455554c776bd3e4f4463662 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shadeforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7eea02ef501299fe8810df8e336242386a2ed75d455554c776bd3e4f4463662 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48594 Malicious code in gamenodev21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed42bff5f057d49a644923b46ba868c04890e51c77dffc911c3aaa0be4e0640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gamenodev2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b3f4352a6a3cd544967811466ca6b70f6171d40b606d11f2b3375921c68d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48593 Malicious code in gamenodev2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b3f4352a6a3cd544967811466ca6b70f6171d40b606d11f2b3375921c68d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48590 Malicious code in baidu-tims (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8df1a41ee221825ba6e320bbed60cefc43c2254a86e89ff493988c7b5ee8ad3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in baidu-tims (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8df1a41ee221825ba6e320bbed60cefc43c2254a86e89ff493988c7b5ee8ad3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chalk-ipheriv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14aef23722696ac10bcadbe24bba51c3dbdc0e9b1e0aa9477a91bc90d59cd48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48591 Malicious code in chalk-ipheriv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14aef23722696ac10bcadbe24bba51c3dbdc0e9b1e0aa9477a91bc90d59cd48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48592 Malicious code in discord-utils-enhanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 678d1a77a40407ca303a4cb46ec3bafa609ffa4d3e354eac59e799a499fb4b68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-utils-enhanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 678d1a77a40407ca303a4cb46ec3bafa609ffa4d3e354eac59e799a499fb4b68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-compiler-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4aae44a97a8da023c5a1e6a16ecf72e6213bbaeb5ec752ea9e903d15a1287d79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-motionflex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45e8b8aeb958d83e7620d1b2039259900e9862ef2e915dd553d1d227ec50dabd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48598 Malicious code in tailwindcss-motionflex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45e8b8aeb958d83e7620d1b2039259900e9862ef2e915dd553d1d227ec50dabd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b6d6c0aead094725047d0ea623f7c50d3f1c9634f1381cdf31a484100178974 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...