PT-2025-32419 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions 4.13.8 through 4.16.2 Craft versions 5.5.8 through 5.8.3 Description: Craft is a platform for creating digital experiences. A vulnerability exists that allows bypassing security measures, potentially leading to remote code...

Onion Site Template 信任管理问题漏洞

Onion Site Template is a self-hosted example from Vessel9817 Individual Developer. Onion Site Template suffers from a trust management issue vulnerability that stems from the inclusion of a fixed tor mirror, which could lead to a compromised website...

MAL-2025-6388 Malicious code in dhei-0731-pkg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe8d7b6c360cad159d0e612206bf57a2317fd56b354a52d680325314989891c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dhei-0731-pkg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe8d7b6c360cad159d0e612206bf57a2317fd56b354a52d680325314989891c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

After a successful phishing attack, new versions of `num2words` were published containing malware.

The num2words project was compromised via a phishing attackand two new versions were uploaded to PyPI containing malicious code.The affected versions have been removed from PyPI,and users are advised to remove the affected versions from their environments...

IR Trends Q2 2025: Phishing attacks persist as actors leverage compromised valid accounts to enhance legitimacy

Phishing remained the top method of initial access this quarter, appearing in a third of all engagements - a decrease from 50 percent last quarter. Threat actors largely leveraged compromised internal or trusted business partner email accounts to deploy malicious emails, bypassing security contro...

MAL-2025-6356 Malicious code in @video-platform/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fae9ea6eb2ddbd946f062bfe5a8bc4d21e1f8865cadc827161ecbaa0a1ae683a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6358 Malicious code in @video-platform/react-osd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1da44cdfe8c5208f12300bf0c4c194e63b2c04b4bd437c4dc12886e9a2e8169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6352 Malicious code in @hypervector/hypervector-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c545f2259849fbb80d4250dcbd736a7ec8fda86cb48ffb7b4a2b1b6eaacfa614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6351 Malicious code in @hypervector/hypervector-tbank-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae2dc7f1e6383a12599beba2e8e9b506edafebb226ed53ed821562057b794d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6354 Malicious code in @platform-ui-storybook/copy-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e323e7bb8e179a68d3e2eec325fc2fb74cd4e41d7a23453369f904e8fc03fd9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6364 Malicious code in mimelib2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63ffee5ddddfafc58e3b65b97a362d842d02a6284d4d51de3c6dcce98b7eb1cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6380 Malicious code in vite-simpleparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d3836a7e7ded3a3b153bf7f32248516a0568c53e4abd6ecb2003a30197daaa0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6378 Malicious code in vite-postcss-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3ccfb9649799b2451c498f5d749045e87056e774d48d5463c04488ec58620fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6376 Malicious code in vite-log-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e278049c2919582d9fdb72033c214b715cd3cf34a0a80051a894185c4f669207 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6375 Malicious code in vanilla-cacher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a170174d56e5363e8c8a3d47eb94f80f3b3dc18a2bf2240e372730ffe076ca97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6372 Malicious code in real-socket-rt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 897bfab5a2a7a305ab43ec0ffd356a56000463ad0f0c9c77731d1aa197aca121 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-qrcode-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7415d66ef3e5a6e0067c5808f2f7929a2e7ec2b74003252747a89dfe7341b50b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-icon-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dc16e0765ddb06bcc46c49b58deba17ff9d4fce6cc5b65ebba0f617cf44fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6370 Malicious code in react-icon-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dc16e0765ddb06bcc46c49b58deba17ff9d4fce6cc5b65ebba0f617cf44fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...