MAL-2025-3051 Malicious code in @hongfangze/proc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f03a11e4b797bafcba512ee070a89bb308a5c0822ca5da8a5c5b580d8269c326 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hongfangze/calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62ce8da37d7e1e8677cceb4a5db36f031470df22a7996162be8d54154076796a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3044 Malicious code in @hongfangze/guid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd7220c6bb13c845faf097d4684a1e9ebf6bf2d825956bd8f565b996a804a193 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @hongfangze/concurrent

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3037 Malicious code in @hongfangze/convert (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58a6ee6ea5b224ab24892e45f1a473b53c5fa5cf89b93c73a62688b2790eb9c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3055 Malicious code in @hongfangze/string (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91ee35af30acd3517cea9a097e00846a80a50fb6888854e7356c5175841b91d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3032 Malicious code in @atulrv1day/unusedpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77df872b6f487ff391d16643aa0a160f89d08f54054931319a0bdb4bc172aaf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3061 Malicious code in accountlifecycleserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16f34b0df0c6872e171130fd0bc4e705f393a5c3a6160b222dab34564f599b92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in niji-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b0f37153a7862a4b1e5abd871385e93b6535a8bb834f03fc9bb83b9e7be6640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3081 Malicious code in niji-react-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db947d966d8d0b7be248b2cc89616fdf14c8a5f7b2d6c7ca11dbfebe6e851914 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in calendar-card-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in airbnb-dls-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d026d9563a73efac2558b2cf71cd6696600aecb85004606ba3dd3a87100bad0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nemo-dast-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38ea0189209023ae2d04586bfbc3d791022f0fa6052dee65ec03832a80ce67a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3059 Malicious code in @nationalgeographicsociety/ngsui-core-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c79788b32fb541eecf3d0b0268cd2e201328ab9caf252358c1f9106c193acf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3071 Malicious code in mahesh.dojo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8bce47a87fb6050b1d2865e5c616c2b3deaaed0cd8b0346e0ede24ecd94371 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3058 Malicious code in @nationalgeographicsociety/ngsui-addons-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d522cf6892b9363520f72cb2c024bbcf7d63238df065658694ca622082b1be9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-14510 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.503 and earlier Jenkins LTS versions 2.492.2 and earlier Description: A missing permission check in Jenkins allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent,...

PT-2025-14511 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.503 and earlier Jenkins LTS versions 2.492.2 and earlier Description: A missing permission check in Jenkins allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gainin...

CVE-2025-31721: Missing Authorization

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration...

CVE-2025-31720: Missing Authorization

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration...