47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by CVE-2025-71389 via next (>=15.5.0, <=15.5.6)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-71389 Source advisory: OSV:GHSA-9QR9-H5GF-34MP...

EUVD-2025-201049

Malicious code in elf-stats-tinsel-train-397 npm...

@4399ywkf/router (>=0.0.1, <=0.0.4), @akash-aw/aw-wizard-forms (4.14.0) +129 more potentially affected by CVE-2025-55182 via @modern-js/utils (>=2.65.2, <=2.69.2)

@modern-js/utils NPM version =2.65.2, =0.0.1, =1.0.0, =1.0.0, =0.44.0, =2.23.0, =0.3.53, =1.0.1, =0.30.0, =0.3.0-alpha.1, =0.4.3, =1.3.0, =2.0.0 and more Source cves: CVE-2025-55182 Source advisory: SNYK:JS-MODERNJSUTILS-14723360...

ai-sdk-provider-claude-code (>=0.2.0, <=1.1.1), claude-code-webui (>=0.1.34, <=0.1.50) +6 more potentially affected by CVE-2025-66032 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.90)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.27, =0.0.28 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-66032 Source advisory: OSV:GHSA-XQ4M-MC3C-VVG3...

MAL-2025-192124 Malicious code in elf-stats-rooftop-hammer-580 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00f8e0b61802c2ebee9fe5ddb54aee5ab39d5cd53e658b235a4543c99e91e383 The package elf-stats-rooftop-hammer-580 was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-200932

Malicious code in elf-stats-evergreen-bow-653 npm...

Malicious code in elf-stats-merry-chimney-765 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0435e21ddce3b9d114ac17bbe0bcb5977f29f67aed49768c7273851c2f70b703 The package elf-stats-merry-chimney-765 was found to contain malicious code...

Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It

The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminde...

Picklescan Bugs Allow Malicious PyTorch Models to Evade Scans and Execute Code

Three critical security flaws have been disclosed in an open-source utility called Picklescan that could allow malicious actors to execute arbitrary code by loading untrusted PyTorch models, effectively bypassing the tool's protections. Picklescan, developed and maintained by Matthieu Maitre...

A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software

Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...

GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN .example.com...

GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools

The supply chain campaign known as GlassWorm has once again reared its head, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks like Flutter, React, Tailwind, Vim, and Vue. GlassWorm was first documented in...

CVE-2025-65112

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...

Malicious Package

Overview chain-selectors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in stream-xor-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc5f6f6ecd6b8dc9aa3f0b220d7281e20d4cdb8d668fad3b2eaf3d574b5c1803 The package stream-xor-chain was found to contain malicious code. Source: ghsa-malware 5fa72b796385b0370be584212f5220a4a6e6960e840a4e700b2df2f99e7be1...

EUVD-2025-200183

Malicious code in stream-xor-chain npm...

Malicious Package

Overview stream-xor-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-191543 Malicious code in stream-xor-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc5f6f6ecd6b8dc9aa3f0b220d7281e20d4cdb8d668fad3b2eaf3d574b5c1803 The package stream-xor-chain was found to contain malicious code. Source: ghsa-malware 5fa72b796385b0370be584212f5220a4a6e6960e840a4e700b2df2f99e7be1...

S3C2 SICP Summit 2025-06: Vulnerability Response Summit

Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US and EU governments and industry are equally interested in enhancing software security, including supply chain and...

Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact

A deeper look at the Shai-Hulud 2.0 supply chain attack: reviewing the infection spread, victimology, leaked secrets distribution, and community response so far...