Malicious code in @voiceflow/dtos-interact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da307584309abbc16bc106ef1077c1719a9496cf4d3fac9cd2843fd76e77f8d6 The package @voiceflow/dtos-interact was found to contain malicious code. Source: ghsa-malware...

@voiceflow/react-chat (>=1.59.4 <=2.62.4), @voiceflow/sdk-runtime (>=1.18.1 <=1.29.0-alpha.1) potentially affected by unknown CVE via @voiceflow/dtos-interact (>=1.10.0 <=1.26.0)

@voiceflow/dtos-interact NPM version =1.10.0, =1.59.4, =1.18.1, =1.29.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-191343...

EUVD-2025-199419

Malicious code in @voiceflow/dtos-interact npm...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

@voiceflow/react-chat (>=1.59.4 <=2.62.4), @voiceflow/sdk-runtime (>=1.18.1 <=1.29.0-alpha.1) potentially affected by unknown CVE via @voiceflow/dtos-interact (>=1.10.0 <=1.26.0)

@voiceflow/dtos-interact NPM version =1.10.0, =1.59.4, =1.18.1, =1.29.0-alpha.1 Source cves: unknown CVE Source advisory: SNYK:JS-VOICEFLOWDTOSINTERACT-14103405...

Malicious code in paychex_app_company_legacy_dtos (npm)

The package paychexappcompanylegacydtos was found to contain malicious code...

MAL-2025-28940 Malicious code in paychex_app_company_legacy_dtos (npm)

The package paychexappcompanylegacydtos was found to contain malicious code...

Design/Logic Flaw

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

CVE-2017-6144

CVE-2017-6144 affects F5 BIG-IP PEM 12.1.0–12.1.2, where downloading the TAC database over HTTPS does not verify the server certificate. This enables potential man‑in‑the‑middle tampering or information disclosure by an attacker in a privileged network position. Affected components rely on TAC da...

CVE-2017-6144

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...