CVE-2024-53995

SickChill is an automatic video library manager for TV shows. A user-controlled login endpoint's next parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open...

CVE-2024-53995 GHSL-2024-288: SickChill open redirect in login

SickChill is an automatic video library manager for TV shows. A user-controlled login endpoint's next parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open...

CVE-2024-53995 GHSL-2024-288: SickChill open redirect in login

SickChill is an automatic video library manager for TV shows. A user-controlled login endpoint's next parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open...

MAL-2025-67 Malicious code in keeper-secrets-manager (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-63 Malicious code in aem-guides-wknd-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-72 Malicious code in tt4b (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 566cb941a2928e1680d09217c711e1a56aa24333a874bd07cff988cfa17e31eb Any computer that has this package install...

MAL-2025-62 Malicious code in old-mpl-token-metadata (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6603cd004d4fbdaf7a066de7f7057ad66c4108e0bd8d961201d12f326fc1d7bf Any computer that has this package install...

MAL-2025-59 Malicious code in appboy-web-sdk-v2 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0c15da90dc72a0bf53f2dccb6e0419535a29d50e59fb3de4b5fb7a2f72245ea Any computer that has this package install...

MAL-2025-61 Malicious code in express-v4 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67ebd6ae141b2ad735a5d06a361820acbdba7b725729e8fa795cf1be86282e30 Any computer that has this package install...

MAL-2025-56 Malicious code in @g.genie/api-demo-sample-lib4 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain...

MAL-2025-55 Malicious code in webinarwebhookapp (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88bed070500ab5e1c676af51f01907117803edeb731a3f97079c35ff3ff1f354 Any computer that has this package install...

MAL-2025-52 Malicious code in lambda-demo (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fa7a653e95d7b948968c1605f557ae4f569e78a26d160f8768a44bca1b6f5b Any computer that has this package install...

MAL-2025-53 Malicious code in muzeeglot (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a924cd903cd9ec3511c788b9d1b75874ed09f4786dcf83a141a6424a9dddfd86 Any computer that has this package install...

MAL-2025-54 Malicious code in player-workshop (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2f2abed0d43ff0cb4723fad6e2c44fe25c5a9923cc44294ec1b199b4479d298 Any computer that has this package install...

MAL-2025-50 Malicious code in firefox-ios (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8da1499a4dcf0cde084f83cf51955dee40dfa2217bdc1d01d4b71d3359e9d34 Any computer that has this package install...

MAL-2025-17 Malicious code in facetec-browser-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38f356209be66b9759fe0891f0751be720e7d758d002e5fd1541f0c10619f45c Any computer that has this package install...

MAL-2025-16 Malicious code in zqdl555 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b18d98c2639c2052e5fcb38fd21e609aef6201aa3e78bda2cb13f15227c08a5e Any computer that has this package install...

MAL-2025-14 Malicious code in zqdl222 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68ae567f53d22d83dcf9eeb0487e5de8498b076beba346f2942ce4658c258450 Any computer that has this package install...

MAL-2025-15 Malicious code in zqdl333 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6366a5f4a87b1ca15c8a0edbf77942b242f6a055cce26d3ad4e91ad92e7ae3 Any computer that has this package install...

MAL-2025-10 Malicious code in forcechatter (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e548ac2ba4e7e0cf0cceee4f34c9ae9aed9e72846aad09c730e9c4460d81354 Any computer that has this package install...