MAL-2025-48030 Malicious code in langflow-api-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0d493794349f9fd072b31947424562afcd5b86b1fd642a42cf613d4b363f5cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nokogiri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52d84f0c9be95071bb514b725ec5c700efe36d5b4ebed67b5e36c3f2cbf6d40e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rails-html-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6639c0a00dd79a8b017f59289f23eccd33625402399ac79c43d96fdb92e3b373 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48021 Malicious code in actionmailbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6163cee75f6b07eafd1b574563ddd85a557f61bd171d49c511515a16ce8b4db3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48082 Malicious code in storefront-search-as-you-type (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0e0258430f6ebc7401b9e28828d8433806e188a230f2a687fa206651d72978c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in actionmailbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6163cee75f6b07eafd1b574563ddd85a557f61bd171d49c511515a16ce8b4db3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48026 Malicious code in concurrent-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a9a44087853b6fa03aa9a4f09e51ff827a6d90b6fe4da7c38cc6ef2764ad99d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in concurrent-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a9a44087853b6fa03aa9a4f09e51ff827a6d90b6fe4da7c38cc6ef2764ad99d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pyjwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1303df275ef90069cbd133d9486d1bd0732a401442c275a2c1ca4765fa940d5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in python-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zero-slot-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67e159cc709d3420c86d6676e754cc1f57818b21ccb863dba4d357ab6476c315 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48015 Malicious code in cross-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46f6bdb0e17b0d49c9c3b316cc02bf5fb1964d956cd9a541c6fd2edd0eb5c551 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48016 Malicious code in testcatplzignore2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a8b1d8bd766d3c76c7e4ebb5e2f9226c1b7ae4cfe0c8ffcfd41ec2ad8916520 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testcatplzignore2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a8b1d8bd766d3c76c7e4ebb5e2f9226c1b7ae4cfe0c8ffcfd41ec2ad8916520 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Crimson Collective: A New Threat Group Observed Operating in the Cloud

Introduction Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that...

GHSA-G8C6-8FJJ-2R4M python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

Summary A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use...

MAL-2025-48347 Malicious code in simple-app-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12841bf7b69cb4d4bbfe8fe7d87b976164b92187dae534f07331b5025779b542 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webpack-dev-serve-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb201f67e4df2c2951dcebb70620a58ed8d7c1862d4697b4e14b2e95b6673d84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 1unitest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dbb904ebb44cb658e404afc6f818343f418ddeae078ea07ea9071f4f55c69d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mad-6.0.0.2.2.8. (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5985b89283068d01e7717bb168ba41e27404e7ce870f19f3778b09480208745 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...