MAL-2025-48569 Malicious code in mender-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7de3cf7258b50c3fd2233ed366fed6714e44da530255103d045c71406b2ea081 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in inventory-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05cf59554b75ea72d28437b6c5c03a829a552360ef8cdabf12621be0bc549a11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48573 Malicious code in mender-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7db45b762045779c0566cc967511852ceac9bebb9a2a09ceed1eda3c44c3e296 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-artifact-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17addb465b6ed297d01361f4bf1b6b46f5eb2917622ac0f7b577dae8e7c29cae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48564 Malicious code in deviceconnect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6c1a3984e1cb71a8f8426b3963787a49a096ce770bcabde9e63ca51fa5007e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48562 Malicious code in deviceauth-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81241adb2806e1b1d4e82b160d92edbdbec9ad3e8ba91dab321514de1f14fa75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deviceauth-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81241adb2806e1b1d4e82b160d92edbdbec9ad3e8ba91dab321514de1f14fa75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48589 Malicious code in workflows-enterprise (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b771d1114b155b3dc1b86df3009f418d2291384328cfa8c9f0b0d35e7808b19 Any computer that has this package installed or running should be considered...

ThreatsDay Bulletin: $176M Crypto Fine, Hacking Formula 1, Chromium Vulns, AI Hijack & More

Criminals don’t need to be clever all the time; they just follow the easiest path in: trick users, exploit stale components, or abuse trusted systems like OAuth and package registries. If your stack or habits make any of those easy, you’re already a target. This week’s ThreatsDay highlights show...

CVE-2025-48428

Cleartext Storage of Sensitive Information CWE-312 in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. This issue...

Gallagher Command Centre Server 安全漏洞

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server, which stems from storing sensitive information in clear text and could lead to compromised...

SocGholish Malware Using Compromised Sites to Deliver Ransomware

New research on SocGholish FakeUpdates reveals how this MaaS platform is used by threat actors like Evil Corp and RansomHub to compromise websites, steal data, and launch high-impact attacks on healthcare and businesses worldwide...

Home Depot Halloween phish gives users a fright, not a freebie

We received a timely phishing email pretending to come from Home Depot. It claimed we’d won a Gorilla Carts dump cart that’s a sort of four-wheeled wheelbarrow for anyone unfamiliar—and said it was just one click away. It wasn’t. The whole image in the email was clickable, and it hid plenty of...

Malicious code in js-repack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a80a1c4ce3e508e53f6fbcff1d53486d344d5e88efb691abaad37cc22759f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48553 Malicious code in webpack-compilejsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c67f3bbe4e8eda380dcbe093fc343b501dc38045f134cb5803093a91b9f48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webpack-compilejsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c67f3bbe4e8eda380dcbe093fc343b501dc38045f134cb5803093a91b9f48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deviceconfig (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 334658dd9323b980ee64b7dd16095cb07c51e894ce6d1dc121149bc9ebd3d89a Any computer that has this package installed or running should be considered...

MAL-2025-48545 Malicious code in react-prop-types-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3226e349f00c076cedb138b9c993caebe82069eceb0cfd079c66e79cfde00310 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @jdtaro/dynamic-devtools-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31153e0cd25bffc9c1582e7fe176e131e49c4a1fdfdc58c55cdf25dcd99a5b55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48541 Malicious code in @jdei/codmi-figma-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fecfd138476c3c3b51878bce2a48c0b9d4ffb9f2d5476a90edeef147217eb29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...