MAL-2025-3297 Malicious code in keypair-encryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02f1145632762977fc8763c9f6ee3f5c9272b45196357654217a1bc1ce13bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3697 Malicious code in poc-sim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bc002dd617428d821e25cfa749908affae826cf40db7db85821cb7e344418ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp

Multiple suspected Russia-linked threat actors are "aggressively" targeting individuals and organizations with ties to Ukraine and human rights with an aim to gain unauthorized access to Microsoft 365 accounts since early March 2025. The highly targeted social engineering operations, per Volexity...

Ripple's xrpl.js npm Package Backdoored to Steal Private Keys in Major Supply Chain Attack

The Ripple cryptocurrency npm JavaScript library named xrpl.js has been compromised by unknown threat actors as part of a software supply chain attack designed to harvest and exfiltrate users' private keys. The malicious activity has been found to affect five different versions of the package:...

Malicious code in windpapi-prebuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c10d90b2a66383524d744c13f47a50a2d7dc178d14e8dd14e6167636c4f09f45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3290 Malicious code in nsdhqhlqqka (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f13c553d9b4b49c22bdffaa566e85eafa6970dedeab6c7f1102dfbe4bc70d60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3294 Malicious code in windpapi-prebuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c10d90b2a66383524d744c13f47a50a2d7dc178d14e8dd14e6167636c4f09f45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in quaoqpdizoqsqdqsd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f1f9340c89842abcbd40ae92859a72850ca38d95401add0c0bf3591b5ab8e8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3286 Malicious code in ds-sudqusdqhsdhqsdzoqi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55eabf16c080da1e15e96342ac1293ec79b0ec3b0a1c9045829a396b3ce5c0e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3284 Malicious code in com.adjust.test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1c1175d9d178e089d813fa5fd10a1f34409c94f28af0ef4c4b0aa7d2424c77b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3292 Malicious code in vertex-lba (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a8170a76fcb89603064ada9f6b9c67cf6806bf216e81f92cfb42bb979b77053 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3287 Malicious code in gombot-crypto-jetpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba48695fbf778c02bb57cfbc2de9ca50fd3023213aeaa67d6620451bf15d9463 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3289 Malicious code in log-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0400bb349db4659330ea5f9fe4c12f9223c56f208b6d3a709ac074229e78f913 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in camel-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1098fc52f4799d50da4e83a966625fba756fb0f48d2f27f3fa9b966a972d035b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3281 Malicious code in app-tcm-collab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9845efa51ff619eac49e29ec346e134077cdddf758355d5cc0f1833ee2ad27b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3282 Malicious code in camel-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1098fc52f4799d50da4e83a966625fba756fb0f48d2f27f3fa9b966a972d035b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3285 Malicious code in discord.js-selfbot-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab72c09e960ea50f08197c72eb549889779b0936abc22064b5adc5d2600361a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-32965

CVE-2025-32965 affects xrpl.js, a JavaScript/TypeScript API for the XRP Ledger. Versions 4.2.1–4.2.4 and 2.14.2 are compromised, containing malicious code designed to exfiltrate private keys. The High-risk impact includes potential key exposure and compromised confidentiality and integrity of aff...

CVE-2025-32965 Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely t...

GHSA-33QR-M49Q-RXFX Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

Impact Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. If you are using one of these versions, stop immediately and rotate any private keys or secrets used with affected systems. Version 2.14.2 is also malicious...