Malicious code in @gitlab-test/yarn-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f274342e8c6f4a200134b68b571eb1eb5d9f01c5d28f5d445b0da3fff6808ff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 43 Update: yarnpkg-1.22.22-12.fc43

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 42 Update: yarnpkg-1.22.22-12.fc42

Fast, reliable, and secure dependency management...

EUVD-2019-0447

Malware in sbrugna...

EUVD-2020-0291

Malware in sbrugna...

EUVD-2018-0806

Malware in sbrugna...

EUVD-2018-0816

Malware in sbrugna...

EUVD-2019-0608

Malware in sbrugna...

EUVD-2025-31043

Malicious code in bioql PyPI...

EUVD-2022-1051

Malicious code in bioql PyPI...

EUVD-2022-4410

Malicious code in bioql PyPI...

EUVD-2022-6622

Malicious code in bioql PyPI...

EUVD-2022-0922

Malicious code in bioql PyPI...

EUVD-2025-25475

Malicious code in bioql PyPI...

EUVD-2022-3152

Malicious code in bioql PyPI...

EUVD-2024-0674

Malicious code in bioql PyPI...

Advisory ROSA-SA-2025-3025

software: yarn 1.22.22 WASP: ROSA-CHROME unaffected versions = yarn-1.22.22.22-3 affected versions yarn-1.22.22.22-3 CVE-ID: CVE-2025-9308 BDU-ID: None CVE-Crit: LOW CVE-DESC.: Vulnerability in Yarn before version 1.22.22 in setOptions function of src/util/request-manager.js file. Possible attack...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-59828 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...