MAL-2025-40099 Malicious code in yacht-saturn-uft758-project (npm)

The package yacht-saturn-uft758-project was found to contain malicious code...

MAL-2025-12242 Malicious code in @zalastax/nolb-lion-r (npm)

The package @zalastax/nolb-lion-r was found to contain malicious code...

MAL-2025-11900 Malicious code in @zalastax/nolb-hanl (npm)

The package @zalastax/nolb-hanl was found to contain malicious code...

MAL-2025-12168 Malicious code in @zalastax/nolb-lion-lib (npm)

The package @zalastax/nolb-lion-lib was found to contain malicious code...

MAL-2025-7412 Malicious code in @crabas0npm/nisi-accusantium-modi (npm)

The package @crabas0npm/nisi-accusantium-modi was found to contain malicious code...

Malicious code in symphony-hierarchical-confusion-matrix (npm)

The package communicates with a domain associated with malicious activity...

Command Injection

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Command Injection via improper...

MAL-2025-6373 Malicious code in redux-eslint-saga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d08211092766c0313df71f1e2fe6fa8cf606e4f36570679a1391bda0a5dfd6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6056 Malicious code in @toptal/picasso-popper (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @jmerhi-atl/evil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91620aae25b612bc0174c38ae40a4b87860a8070824a4fbb447968986ad8c368 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5336 Malicious code in themeone-event (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344156a1acdac4db165b08dad861bc3aa76c408f6e85556cce6b9cf2b0834ecb Any computer that has this package installed or running should be considered...

MAL-2025-5254 Malicious code in @lebeaujeu/fake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5e562f5743a5e671405871f188aa608700819920005b4d87e84c882b5843d10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5471 Malicious code in uphold-sdk-javascript-extensions (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5434 Malicious code in math-utils-gava (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbfa97f4de0215f88db05e74ecb15d790ba8221495f33601d48f98303f3f93d4 Any computer that has this package installed or running should be considered...

MAL-2025-5414 Malicious code in hackshack-leaderboard (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-4798 Malicious code in @loybung/encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45bb70dace7a418d2161aade822a8325a2f60579220f62b64c07c32c05b338fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4912 Malicious code in yux-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32619602ea22f43c922bd51fb5af4f417fee447f162999a6e291f7f83a39e9a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-40637

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

Malicious code in @klarna-travel-platform/travel-booking-shared-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f013426be635a2310d1320cacca5b4ce5067f6686d76993ed1ea4ef590315037 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_historia_do_movimento_pentecostal_no_brasil_by_isael_de_araujo_k3o0z (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69b931a05ee3f5829b5d724725a78669b59ea684aa7dd4cf3c030dadad9dc48a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...