Malicious code in helloworldmyworld (npm)

Source: ossf-package-analysis ea11c9b6eb65ebdd9deee023e1154599bc86dce39350a49b2589c88f7dce2b31 The OpenSSF Package Analysis project identified 'helloworldmyworld' @ 1.999.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in hedwig-tsconfig (npm)

Source: ossf-package-analysis 1a650b67b76184573f147a7b286249b1de734cfa85647aea9a9bea3284e155f8 The OpenSSF Package Analysis project identified 'hedwig-tsconfig' @ 99.8.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in heatwallet (npm)

Source: ossf-package-analysis 04a592accda6e728f314fbe238a01ef38f20a2f7a1e0a09aa4099bd79a8650d7 The OpenSSF Package Analysis project identified 'heatwallet' @ 10.1.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. -...

Malicious code in health-check-nodejs (npm)

Source: ossf-package-analysis ef9d93b4469df4d458d4c4a226b45fa7baf7760a84cd3d8b5fc84fb990e0e6ba The OpenSSF Package Analysis project identified 'health-check-nodejs' @ 3.16.1 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in health-cards-validation-sdk (npm)

Source: ossf-package-analysis 83454ca0e6e018fdcd3684ad0e163a9220a0e5a2619ea5d348092076d83755e5 The OpenSSF Package Analysis project identified 'health-cards-validation-sdk' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in hardhat-contract (npm)

Source: ossf-package-analysis 3593917b9125465c1d3c5d6b38c62a9819d7590aea1522bdcf400ffef560a9b7 The OpenSSF Package Analysis project identified 'hardhat-contract' @ 15.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in gx-ui-common (npm)

Source: ossf-package-analysis bd19f4cdc84c6328351c4c3bda0cd8bde0ae5d9ed6b743d85a70f6a50670c6a1 The OpenSSF Package Analysis project identified 'gx-ui-common' @ 1.2.66 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in grv-teleport (npm)

Source: ossf-package-analysis 6dfcd0021e0f1240c60e8000555475ca9c7eef5e0c7da1a3e54dbe3f288b1650 The OpenSSF Package Analysis project identified 'grv-teleport' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ...

Malicious code in gs-uitk-lodash (npm)

Source: amazon-inspector 2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b The package gs-uitk-lodash was found to contain malicious code. Source: ossf-package-analysis c89a6d85d1019b9d98f88e94d18fd4ec4ae045bd6f941941e9bdde517a749fdd The OpenSSF Package Analysis project identified...

Malicious code in groq-link2 (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 41bce2830a85a25120da79481083dd6be69ce23b29f67ed7678a9009bbdb71f7 The OpenSSF Package Analysis project identified 'groq-link2' @ 1.0.23 npm as malicious. It is considered malicious because: - T...

Malicious code in google-youtube (npm)

Source: ossf-package-analysis e1ecb598c9ac0e7240a341182e2f54597b4789e72942b075021ced9bf81aef35 The OpenSSF Package Analysis project identified 'google-youtube' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in gog-module-event-bus (npm)

Source: ossf-package-analysis 4fb2c212daa3b898b2df5ffdf458a7751515e92268bd6b3b13ac45894235be3c The OpenSSF Package Analysis project identified 'gog-module-event-bus' @ 1.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ctags (UTSA-2023-002841)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002841 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filename specified in the command line...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2023-000605)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000605 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

FreeBSD : yt-dlp: Improper Neutralization of Special Elements (cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0 advisory. https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports: yt-dlp and youtube-dl...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-7863

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...