Malicious code in @self-sell/components (npm)

The package @self-sell/components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb15f4ae1c1a830e2fdc21bd8a903fe2e14978eb9952f1e5b3f98f0ca7f353f Any computer that has this package installed or running should be considered fully...

Malware in @team-event/models

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @navancorp/ta-travel

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47047 Malicious code in @self-sell/store (npm)

The package @self-sell/store was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a25554db33ac217aa1afe6e461f5ec9429746b8c3071523cbea2987e8cdc04e Any computer that has this package installed or running should be considered fully...

MAL-2025-47045 Malicious code in @self-sell/guards (npm)

The package @self-sell/guards was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 594bf67cf504a8b4b9f076c7913f69f5a9b3f0677a7528de143d2b247cf3bff7 Any computer that has this package installed or running should be considered fully...

Malicious code in @team-event/models (npm)

The package @team-event/models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6769b5703bfb1b74cb1db2c7bf3e87a4abfcc35e4e3fd588c284080cb96583e2 Any computer that has this package installed or running should be considered fully...

MAL-2025-47035 Malicious code in @liquid-web/guards (npm)

The package @liquid-web/guards was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff39fb3d64f126121b204db1daa7ccf8738a1cc5d70406735a1a9fab3e983691 Any computer that has this package installed or running should be considered fully...

Malicious code in @liquid-web/services (npm)

The package @liquid-web/services was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a793462c570f450eeff1a98416d2df40454d98c04a1a28a4c230f7e55dca690d Any computer that has this package installed or running should be considered fully...

[Extended] Ethics in Computer Security Research: a Data-Driven Assessment of the Past, the Present, and the Possible Future

Ethical questions are discussed regularly in computer security. Still, researchers in computer security lack clear guidance on how to make, document, and assess ethical decisions in research when what is morally right or acceptable is not clear-cut. In this work, we give an overview of the...

Malware in @js-to-lua/convert

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47013 Malicious code in arjvg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cd64f189589f89a129472b58fe6cdad30ec47b3cbbefc805f31d335ed8cac98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in sfly-web-vitals

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in netflix-dea (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54b29496c035b21772b6474b4da2740f75b84c0dfeb189436edf4f9134c6730b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in internal-test-helpers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47010 Malicious code in @pa-client/power-code-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60c9037c2e5ca709c20fd2beb65a40e9649cbc3735c1989647ba5aae2889672d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47097 Malicious code in json-rules-engine-examples (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c055e3188c933741c505c8cf3361cb2eea0557c98870f8b1b963fe27ae7a21a Any computer that has this package installed or running should be considered...

AgentSentinel: an End-To-End and Real-Time Security Defense Framework for Computer-Use Agents

Large Language Models LLMs have been increasingly integrated into computer-use agents, which can autonomously operate tools on a user's computer to accomplish complex tasks. However, due to the inherently unstable and unpredictable nature of LLM outputs, they may issue unintended tool commands or...

Backdoor Attacks and Defenses in Computer Vision Domain: a Survey

Backdoor trojan attacks embed hidden, controllable behaviors into machine-learning models so that models behave normally on benign inputs but produce attacker-chosen outputs when a trigger is present. This survey reviews the rapidly growing literature on backdoor attacks and defenses in the...

MAL-2025-42157 Malicious code in yui2-animation (npm)

The package yui2-animation was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 075f8fc51a15a005755c226c80fb0355dda105449ade6f949deced74ddbd7b56 Any computer that has this package installed or running should be considered fully...

Malware in moodle-core-notification-dialogue

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...