Malicious code in mathjax-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31e9bef117fdc744a0166905e2fe2aba840a07ffa7b09a4320b90476efc7aa46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-lexical (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 760c1ce48f24649d849a333e359e0a3f348f36df412163d82b89e8fc552625f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2688 Malicious code in mathjax-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31e9bef117fdc744a0166905e2fe2aba840a07ffa7b09a4320b90476efc7aa46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2670 Malicious code in eslint-plugin-lexical (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 760c1ce48f24649d849a333e359e0a3f348f36df412163d82b89e8fc552625f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2648 Malicious code in blockzie-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf83c5547a44227263a682edde74a7f24d42f2068c473e9aaf2a9af949d6bb58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blockzie-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4da1a7f59cd66ecf84dc953f33def62ebeb1b32c0d526a2d32b361b967d20dbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blockzie-save-svg-as-png (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12218d7a2fc38f96f07e686aaf4c4e5a76506d1dd69cdb9a90ab2e1346e36e0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in codex-cipher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ce020b1fc0f9d126255429ca44d4407527446d2650c546670d79bc9c84056cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eclipse-tractusx-github-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5357a55497ee86b69ff4768aee0d28461a0f024df6f74c50c2511d1032cf3128 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2617 Malicious code in epic-react-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d43c90ef27f311e9b6bb49fb715a80a16f68e0adef519b5f389a00ceeb8bbf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mctursh/ui-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfa9f046844b3758e4fe0b661cc43cdad31ac94c70eda2029b9713ee4c704b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2612 Malicious code in @mctursh/ui-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfa9f046844b3758e4fe0b661cc43cdad31ac94c70eda2029b9713ee4c704b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-7033

In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...

CVE-2024-8982

A Local File Inclusion LFI vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical dat...

CVE-2024-10819

A Cross-Site Request Forgery CSRF vulnerability in version 3.83 of binary-husky/gptacademic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can...

CVE-2024-9439

SuperAGI is vulnerable to remote code execution in the latest version. The agent template update API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise...

CVE-2024-8487

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

Malicious code in architecture-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4282b66b0052ca80f8717181dbf7b0b94e88433b9e37f9ae718531960f9ddcbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in my-signature (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e0bbf0594c1ce65a05bd238b874f3af6810ddb8729b2f913150d08d07f6a323 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in byted-midas-render-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b801b5ca095df1e96b38bfc8f414ed583b82378f669eea2e6028157e2dbecc94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...