Malicious code in goodluckforu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5854033dc24355896c6c0234a43876ea5cc4b241157df788bec8a3186a995a7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3165 Malicious code in shiroisthebest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e179d4c7188e5eef682908b39cf158311b927536dbae3793020d6d668fb834e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3164 Malicious code in search-benchmark-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83090fc7978d15e4a0ee6c1d633d8998d6b7ce00f6c0ec85ec1e6297d679517e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in legacy-actuator-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d36c556dbf86cb7f6c937329b814614f149810c3959d22139e4f53b29edee481 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3140 Malicious code in ac-async-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18c30e40062c879e036cecb106668987fc0ac36f72dbc91dc345436419e79176 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Web 3.0 Requires Data Integrity

If you've ever taken a computer security class, you've probably learned about the three legs of computer security--confidentiality, integrity, and availability--known as the CIA triad. When we talk about a system being secure, that's what we're referring to. All are important, but to different...

Malicious code in skills-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ddd68a5caf984495eb4aae051d0bdd1bbfb4f1b8163b0dcb86fd996e7f24b16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in adult-content-detection-aws (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c7da4fcfb4de71b19452af0a573b825658e46880b543cb625a25552b249fd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3087 Malicious code in @bmw-fedev/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aaf1cfd96aa6434cb73b22f2e38fda0979e7847fff11c575bd67ea8e2f09c8f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3123 Malicious code in trrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43096da9f5184fd6d2799200367daed2ed6e9654a3731c0035479ec9d1b1bd61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3122 Malicious code in tiktok_4d_webapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee7b2f7d0a2a643de495f8b050981233231b51ed49c2dabb3e2de7b908b9fa7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3107 Malicious code in my-test002-datetime-momo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a688643a119539cf494c667fdedfeb4b5373651b0296fe8252d54d72bd7e30b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3102 Malicious code in invoicelifecycle-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e84b4abbc087a7b5b42ad12ecca83b68ff5f017356808e508ee32f7bfe000a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nva-process-inf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d654f39c1766e74a8a2950ae8ceb43686999ec02923d6454655c6596bd87354b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3109 Malicious code in nva-direct-showof (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d8b4952e45ae0f21b713b389d983c27d4b09a8410a0416bfd8efb2b2923ff02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-565R-PF5Q-45V6 Jenkins Missing Permission Check

Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration. Jenkins 2.504, LTS 2.492.3 require...

Missing Authorization

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Authorization in the doCreateItem method. A user with Computer/Create permission can copy an agent and thereby access its configuration. Remediation Upgrade...

GHSA-WR6W-JXG7-QPFH Jenkins Missing Permission Check

Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration. This is due to an...

CVE-2025-31721

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration...

CVE-2025-31720

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration...