MAL-2025-4917 Malicious code in ac-mvc-data-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e9462eb068cce8b3da98f703f0be4a19c54ddaf088f9b6f23613ec34adbaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4736 Malicious code in copy-package-contents (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 219b6f163c59d78fd936297643511fdfb25a63f8ed99ce66949104cdf17efcad Any computer that has this package installed or running should be considered...

MAL-2025-4362 Malicious code in input_control_vis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 847f16a101f10748b070eeb4095740ff11a6df777e8e80990e1655548a9585da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4317 Malicious code in com.unity.cloud.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46d26c76ae3c3c9d4f0975262f4b276f17bdaa1b436737ff8fa006f42576d8d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3969 Malicious code in placeholdr (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7d66d11f753c13ea251285ba697e1ec1be39a242effd08950d5fb3fff850ca7 Any computer that has this package installed or running should be considered...

CVE-2025-32883

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-41722. Reason: This candidate is a reservation duplicate of CVE-2024-41722. Notes: All CVE users should reference CVE-2024-41722. instead of this candidate. All references and descriptions in this candidate have been removed ...

SpyNote, BadBazaar, MOONSHINE Malware Target Android and iOS Users via Fake Apps

Cybersecurity researchers have found that threat actors are setting up deceptive websites hosted on newly registered domains to deliver a known Android malware called SpyNote. These bogus websites masquerade as Google Play Store install pages for apps like the Chrome web browser, indicating an...

MAL-2025-3200 Malicious code in solana-candles-oracle-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c9505d4ee620ab7696e0bb4f2680eaea2d24795900244ef09291a911f0e7562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2128 Malicious code in serum-anchor-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c43199561186f5ce43ff0fd760c87d56375a9c388bbd6f058d1dfe4d4c0f4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Your Health Information Was Compromised. Now What?

The healthcare industry has become increasingly reliant on technology to enhance patient care, from advanced image-guided surgery to…...

MAL-2025-345 Malicious code in qa-octuple (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39769cce5e70e9098087bffcf45c754636b295ed521042bad3bdae8a0debf88c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-X684-96HH-833X Craft CMS has a potential RCE with a compromised security key

Impact This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. https://craftcms.com/knowledge-base/securing-craftkeep-your-secrets-secret Anyone running an unpatched version of Craft with a compromised security key is affected. Patche...

Craft CMS has a potential RCE with a compromised security key

Impact This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. https://craftcms.com/knowledge-base/securing-craftkeep-your-secrets-secret Anyone running an unpatched version of Craft with a compromised security key is affected. Patche...

CVE-2025-23209

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a...

CVE-2025-23209 Potential RCE with a compromised security key in craft/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a...

CVE-2025-23209 Potential RCE with a compromised security key in craft/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a...

MAL-2024-10521 Malicious code in puppeteerscroll-down (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef54ed97acfe5ef98e20301d2c06ccf2391055cb225e5c1cc48bc06950e82d6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-47127 Weak Authentication in goTenna Pro

In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the...

MAL-2024-8952 Malicious code in node-request-ip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb84b66f2d901a52fe5355ab09edbd3226fb91b8c6dd7afd2ec2353390488822 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8387 Malicious code in @diotoborg/itaque-suscipit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75baf3356598902c159fbb69b0222ed36dc06c18a000438807566d2d06bb833d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...