Malicious code in swagger-express-evaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b56a0de351341937c692d88411f2d8b6c638192e34d63cef6c3815aa379d278 The package swagger-express-evaluator was found to contain malicious code. Source: ghsa-malware...

MAL-2025-66549 Malicious code in swagger-express-evaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b56a0de351341937c692d88411f2d8b6c638192e34d63cef6c3815aa379d278 The package swagger-express-evaluator was found to contain malicious code. Source: ghsa-malware...

Prototype Pollution

Overview expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providing...

Prototype Pollution

Overview org.webjars.npm:expr-eval is a WebJar for expr-eval Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providin...

JavaScript Expression Evaluator 安全漏洞

JavaScript Expression Evaluator is a math calculator by Matthew Crumley Personal Developer. A security vulnerability exists in JavaScript Expression Evaluator that stems from insufficient input validation and could lead to the execution of arbitrary code...

EUVD-1999-0476

Malware in sbrugna...

EUVD-2013-4157

Malware in sbrugna...

EUVD-2009-5091

Malware in sbrugna...

EUVD-2025-7039

Malicious code in bioql PyPI...

EUVD-2023-1967

Malicious code in bioql PyPI...

EUVD-2023-35056

Malicious code in bioql PyPI...

EUVD-2025-0127

Malicious code in bioql PyPI...

EUVD-2025-7110

Malicious code in bioql PyPI...

MAVUL: Multi-Agent Vulnerability Detection Via Contextual Reasoning and Interactive Refinement

The widespread adoption of open-source software OSS necessitates the mitigation of vulnerability risks. Most vulnerability detection VD methods are limited by inadequate contextual understanding, restrictive single-round interactions, and coarse-grained evaluations, resulting in undesired model...

A week in security (September 15 – September 21)

Last week on Malwarebytes Labs: ChatGPT Deep Research zero-click vulnerability fixed by OpenAI Disrupted phishing service was after Microsoft 365 credentials Update your Chrome today: Google patches 4 vulnerabilities including one zero-day Age verification and parental controls coming to ChatGPT ...

Prototype Pollution

Overview expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via the evaluation process, which accesses global values by searching for item.value in expr.functions. An attacker can access prototype, proto, constructor, and assig...

Prototype Pollution

Overview expr-eval-fork is a Mathematical expression evaluator fork with prototype pollution fix Affected versions of this package are vulnerable to Prototype Pollution via the evaluation process, which accesses global values by searching for item.value in expr.functions. An attacker can access...

Watch out for the “We are hiring” remote online evaluator message scam

Looking at our team’s recent text messages, you’d think that remote online evaluators are in high demand right now. Several members of our team have received the almost exact same job offer scam texts. The content of the messages is almost identical, but there is a variation in background images...

Security Bulletin: Arbitrary Code Execution via JaninoEventEvaluator in Logback-Core (Versions 0.1–1.3.14, 1.4.0–1.5.12) through Malicious Configuration or Environment Variable Injection affects watsonx.data

Summary ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before...

[SECURITY] Fedora 42 Update: python-asteval-1.0.6-1.fc42

ASTEVAL is a safeish evaluator of Python expressions and statements, using Python's ast module. The idea is to provide a simple, safe, and robust miniature mathematical language that can handle user-input. The emphasis here is on mathematical expressions, and so many functions from numpy are...