Malicious code in isctf5 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ded9b3952043478fcfdc7ddc981925d7e31160b4a096e205cf35950e5787d2a2 Any computer that has this package installed or running should be...

MAL-2025-740 Malicious code in isctf2 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 539f5cd801a6661acb135e95f2a3d7e10131795d17c2395ae0b3b804a3263b7d Any computer that has this package installed or running should be...

Malicious code in isctf2 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 539f5cd801a6661acb135e95f2a3d7e10131795d17c2395ae0b3b804a3263b7d Any computer that has this package installed or running should be...

MAL-2025-738 Malicious code in isctf16 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 236c481ceb4416a920a9cf23c72217913d688a6e2aa10edf1f633acecdaf131b Any computer that has this package installed or running should be...

MAL-2025-742 Malicious code in isctf4 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9aa3ab73f09ab46f718934ee549dde163b232a5e7b76a90a95aab9dc738370a4 Any computer that has this package installed or running should be...

MAL-2025-737 Malicious code in isctf11 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c33f3136f471972ddafc623ece4be1fd82a54838cc113de8a230a98f02ecd94 Any computer that has this package installed or running should be...

MAL-2025-741 Malicious code in isctf3 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef062f634bf94ff3d92de69f61ddc08a1d9351db44ff84be85fc5eba8c05b23 Any computer that has this package installed or running should be...

CISA: Contec CMS8000 Contains a Backdoor

This fact sheet details an analysis of three firmware package versions of the Contec CMS8000, a patient monitor used by the U.S. Healthcare and Public Health HPH sector. Analysts discovered that an embedded backdoor function with a hard-coded IP address and functionality that enables patient data...

CVE-2025-0626

The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is disabled. The function is triggered by attempting to...

CVE-2025-0626

creationtimestamp| type| source ---|---|--- 2025-01-30 18:23:26+00:00| seen| https://infosec.exchange/users/cve/statuses/113918699498185844 2025-01-30 22:30:06+00:00| seen| https://bsky.app/profile/mytechnotalent.bsky.social/post/3lgyjvwampk2s 2025-01-30 22:38:31+00:00| seen|...

CVE-2025-0626 Hidden Functionality vulnerability in Contec Health CMS8000 Patient Monitor

The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is disabled. The function is triggered by attempting to...

CVE-2025-0626

The CVE-2025-0626 issue concerns Contec CMS8000 CMS8000 Patient Monitor firmware where the monitor binary attempts to mount to a hard-coded routable IP, bypassing device network settings, and can enable the network interface if it is disabled. Triggered during a device update from the user menu, ...

CVE-2025-0626 Hidden Functionality vulnerability in Contec Health CMS8000 Patient Monitor

The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is disabled. The function is triggered by attempting to...

Malicious code in node-telegram-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fa53b655e6444ccce46488f04d3dcf7f427354b64c286c652de18e947c2c74 Any computer that has this package installed or...

MAL-2025-628 Malicious code in node-telegram-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fa53b655e6444ccce46488f04d3dcf7f427354b64c286c652de18e947c2c74 Any computer that has this package installed or...

Malicious code in @zohaib2121/dtapp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27f5d74d5d130aff4fd7d231b3d9cd57faedebb2a8cc7f462d33e36d00764d50 Any computer that has this package installed or running should be considered...

Malicious code in telegram-util (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 259b69f583bb3ea0fcb76890f5361a9c8e9d784fcca352a51f4dd13e7d73e1c7 Any computer that has this package installed or...

Malicious code in grammyjs-utils (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45f0349da339aac302d4c3bf992403e9bd539caa80f29576e448ccf3fb4af016 Any computer that has this package installed or...

MAL-2025-625 Malicious code in grammyjs-utils (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45f0349da339aac302d4c3bf992403e9bd539caa80f29576e448ccf3fb4af016 Any computer that has this package installed or...

MAL-2025-629 Malicious code in telegram-util (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 259b69f583bb3ea0fcb76890f5361a9c8e9d784fcca352a51f4dd13e7d73e1c7 Any computer that has this package installed or...