CVE-2025-71351

CVE-2025-71351 affects picklescan prior to version 0.0.25. The vulnerability arises because timeit.timeit() calls used in the reduce method are not detected by the tool, allowing crafted pickle payloads to bypass detection and trigger remote code execution when pickle.load() is performed. Attacke...

GHSA-F8H5-X737-X4XR `finch-rust` was removed from crates.io for malicious code

It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files...

Malicious Package

Overview syntax-flow is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

MAL-2025-17638 Malicious code in cover-background (npm)

The package cover-background was found to contain malicious code...