debug 安全漏洞

debug is a small JavaScript debugging utility open-sourced by Debug.js modeled on core Node.js debugging techniques. A security vulnerability exists in debug version 4.4.2, which stems from a phishing attack leading to account takeover, where malware may redirect cryptocurrency transactions...

node-error-ex 安全漏洞

node-error-ex is a library by Josh Junon Personal Developer. A security vulnerability exists in node-error-ex version 1.3.3, which stems from a phishing attack resulting in an account takeover, and a malicious version that contains a specially crafted payload that could redirect cryptocurrency...

simple-swizzle 安全漏洞

simple-swizzle is a codebase by Josh Junon Personal Developer. A security vulnerability exists in version 0.2.3 of simple-swizzle that stems from a phishing attack resulting in account takeover and implanted malware that may redirect cryptocurrency transactions...

color-name 安全漏洞

color-name is a JavaScript library open-sourced by color.js. A security vulnerability exists in color-name version 2.0.1, which stems from a phishing attack resulting in an account takeover that could redirect cryptocurrency transactions...

Backslash 安全漏洞

Backslash is a tool for parsing backslash strings by the individual developer Josh Junon. A security vulnerability exists in Backslash version 0.2.1, which stems from a malware payload that could lead to the redirection of cryptocurrency transactions...

color-convert 安全漏洞

color-convert is a color conversion function in JavaScript by Josh Junon Personal Developer. A security vulnerability exists in color-convert version 3.1.1, which stems from malicious code implanted after a phishing attack on an account, and could lead to the redirection of cryptocurrency...

color 安全漏洞

color is a Javascript manipulation library by Josh Junon Personal Developer. A security vulnerability exists in color version 5.0.1 that stems from a phishing attack resulting in an account takeover, where malware may redirect cryptocurrency transactions in the browser environment...

CVE-2025-59038

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fix...

When Dependencies Turn Dangerous: Responding to the NPM Supply Chain Attack

On September 8, 2025, attackers compromised a set of 18 widely used npm packages —including chalk, debug, ansi-styles, and strip-ansi—collectively downloaded over 2.6 billion times per week. Through a targeted phishing campaign against a maintainer, the attackers published malicious versions...

CVE-2025-59037

CVE-2025-59037 covers DuckDB npm packages where four Node.js packages were briefly compromised with malware: @duckdb/[email protected], @duckdb/[email protected], [email protected], and @duckdb/[email protected]. The malicious versions attempted to interfere with cryptocurrency transactions. DuckDB de...

RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities

A new Android malware called RatOn has evolved from a basic tool capable of conducting Near Field Communication NFC relay attacks to a sophisticated remote access trojan with Automated Transfer System ATS capabilities to conduct device fraud. "RatOn merges traditional overlay attacks with automat...

Malicious code in @duckdb/node-api (npm)

The DuckDB Node.js package @duckdb/node-api version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

MAL-2025-46993 Malicious code in @duckdb/node-bindings (npm)

The DuckDB Node.js package @duckdb/node-bindings version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer's account was compromised in a phishing attack. The attack targeted Josh Junon aka Qix, who received an email message that mimicked npm "[email protected]", urging them to update their update...

Prebid.js 安全漏洞

Prebid.js is Prebid's open source software for setting up and managing header bidding ad co-op. A security vulnerability exists in Prebid.js version 10.9.2, which stems from malicious code being planted in npm packages that could redirect cryptocurrency transactions...

DuckDB 安全漏洞

DuckDB is an in-process SQL OLAP database management system from DuckDB open source. A security vulnerability exists in DuckDB that stems from malicious code being planted in npm packages that could interfere with cryptocurrency transactions. The following products and versions are affected: duck...

Prebid Universal Creative 安全漏洞

Prebid Universal Creative is an interface software from Prebid Open Source. A security vulnerability exists in Prebid Universal Creative version 1.17.3, which stems from malicious code being planted in npm packages that could interfere with cryptocurrency transactions...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code activates a hook whenever a Web3 wallet is present...

Embedded Malicious Code

Overview duckdb is a Node.js API for DuckDB, the "SQLite for Analytics". The API for this client is somewhat compliant to the SQLite Node.js client for easier transition and transition you must eventually. Affected versions of this package are vulnerable to Embedded Malicious Code. This package...

Embedded Malicious Code

Overview color-string is a Parser and generator for CSS color strings Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicio...