MAL-2025-6 Malicious code in grr-ui (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 345ae424d27b9cf2f744a7f8c06a861ea649e38119ef4321c09f6cccae526d0a Any computer that has this package install...

MAL-2025-7 Malicious code in treedome (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 684ae3e40b1c465aa22e0c0351dbd7dee0a7ebd2216a70b401167c95ae3b87d2 Any computer that has this package install...

MAL-2025-44 Malicious code in lana-docs-site (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware accb6c4448ea69a1e84f45256921e0bca2f42e0f2cb6ad93d0e60ed843b843f0 Any computer that has this package install...

MAL-2025-43 Malicious code in grafana-sentry-datasource (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f64ac119461c222b3a037a8fb79c1239e05e03cbce16d87f17ce6f1bb3a857a7 Any computer that has this package install...

MAL-2025-3 Malicious code in safe-apps-react-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4844f797621f2cd62b20851643278b7d27cfc2ca46fdd1485383cd7818d5c0a8 Any computer that has this package install...

MAL-2025-2 Malicious code in payouts-banking-info (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d795b5a9cc9952f39cd020e529f31f96f837544ae12bdb31f13d66970d9824d4 Any computer that has this package install...

MAL-2024-12175 Malicious code in fider (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e33a8112ebd5139a50734b023e3b935048b314e8fd783e73722625dd79241c69 Any computer that has this package install...

MAL-2024-12171 Malicious code in mx-exchange-docs (npm)

This package exfils sensitive data to a attacker-controlled domain via index.js. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86097f31b903420b95d8b161339744186e28bf4894231a435e0889e51ef07a8e Any computer that has this package installed or running should be...

MAL-2024-12177 Malicious code in babel-preset-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c7766597c4e69a6b6b08fb89e552f8cff845299eb1b612ef107e5f3fcb96156 Any computer that has this package install...

MAL-2024-12169 Malicious code in faucet-microservice (npm)

This package exfils sensitive data to a attacker-controlled domain via index.js. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d09b2cef4e107bb3f98de2f43a639670bd0e2bb64a519c56e6c2c216c371659 Any computer that has this package installed or running should be...

MAL-2024-12173 Malicious code in solaraexecutor (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8807e1265b0c39afd3a6507559deb211f67d9a559b8094aecea14d18f30dcf7 Any computer that has this package...

MAL-2024-12172 Malicious code in officebrowserfeedback (npm)

This package exfils sensitive data to a attacker-controlled domain via index.js...

MAL-2024-12174 Malicious code in xeno.dll (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8903fab539c0352f278ee3116807f48f52403f7e26b855fe9d68c3328012200d Any computer that has this package...

MAL-2024-12162 Malicious code in v2-foundry (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 761f1bf228ed4db14be182b91d2442d9b00aa33e118b7d0e3e341bf015eac5b9 Any computer that has this package install...

MAL-2024-12160 Malicious code in unisocks (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7048c72cc0d604b91309e2009ab3661aa15f1f3199079d12871d1a54a2041b6b Any computer that has this package install...

MAL-2024-12161 Malicious code in crypto-buddies (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87bd38c4e59327027fe55c21e59d50ddf6e0ecd5c9a488ed53932639fa8927fb Any computer that has this package install...

Malicious code in unisocks (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7048c72cc0d604b91309e2009ab3661aa15f1f3199079d12871d1a54a2041b6b Any computer that has this package install...

age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs. ...

RUSTSEC-2024-0432 Malicious plugin names, recipients, or identities can cause arbitrary binary execution

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or an attacker-controlled plugin name via the -j flag. On UNIX systems, a directory...

Malicious plugin names, recipients, or identities can cause arbitrary binary execution

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or an attacker-controlled plugin name via the -j flag. On UNIX systems, a directory...