CVE-2025-56803

CVE-2025-56803 OS Command Injection Vulnerability via Plugin Execution in Figma Desktop Application 1. Overview Application : Figma Desktop Application Version : 125.6.5 Vendor : Figma, Inc. CWE : CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' CVS...

Malicious Package

Overview figma-to-apl is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in figma-to-apl (npm)

figma-to-apl is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious code in figma-to-apl (npm)

figma-to-apl is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

MAL-2026-17433 Malicious code in figma-to-apl (npm)

figma-to-apl is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious Package

Overview mcp-server-figma is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in mcp-server-figma

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bigops-figma-to-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d43dbcd2d43f28af8266fac2d7e08a782dfbaaac1d02375438095a8001b24e On require, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint, fetches an opaque binary from author-controlled...

Malicious code in figma-d2c-utils (npm)

Source: amazon-inspector b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f The package ships dist/report.js, a one-line module that issues an HTTPS POST to https://www.baidu.com carrying values read from process.env. The destination has no relationship to the package's stated purpo...

Malicious Package

Overview figma-d2c-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mcp-server-figma (npm)

Source: amazon-inspector 474223e0d5456564c1ae112031e3b8f276850a79f59cc93ed3a04805de291f20 Package squats the unscoped name mcp-server-figma, which AI coding agents and developers commonly invoke via npx mcp-server-figma expecting the legitimate Figma MCP server which uses a scoped name. The...

Malicious Package

Overview @amber-team/figma-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in @amber-team/figma-utils (npm)

The package @amber-team/figma-utils was found to contain malicious code. --- Credit: OpenSSF source...

iflow-mcp-kdoronin-figma-mcp (>=0.1.0, <=0.1.1), rootly-mcp-server (>=2.0.0, <=2.0.1) potentially affected by CVE-2025-64340 via fastmcp (2.4.0)

fastmcp PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - iflow-mcp-kdoronin-figma-mcp =0.1.0, =2.0.0, =2.0.1 Source cves: CVE-2025-64340 Source advisory: OSV:PYSEC-2026-2475...

cratedb-mcp (0.0.3), figma-to-compose-mcp (>=0.1.0, <=1.1.1) +7 more potentially affected by CVE-2025-64340 via fastmcp (2.6.1)

fastmcp PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cratedb-mcp 0.0.3 - figma-to-compose-mcp =0.1.0, =0.1.0, =0.1.0, =0.0.2, =1.0.0, =3.0.0, =3.0.2 Source cves: CVE-2025-64340 Source advisory:...

iflow-mcp-kdoronin-figma-mcp (>=0.1.0, <=0.1.1), rootly-mcp-server (>=2.0.0, <=2.0.1) potentially affected by CVE-2026-27124 via fastmcp (2.4.0)

fastmcp PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - iflow-mcp-kdoronin-figma-mcp =0.1.0, =2.0.0, =2.0.1 Source cves: CVE-2026-27124 Source advisory: OSV:PYSEC-2026-2476...

iflow-mcp-kdoronin-figma-mcp (>=0.1.0, <=0.1.1), rootly-mcp-server (>=2.0.0, <=2.0.1) potentially affected by CVE-2026-32871 via fastmcp (2.4.0)

fastmcp PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - iflow-mcp-kdoronin-figma-mcp =0.1.0, =2.0.0, =2.0.1 Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...

Malicious code in figma-d2c-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f The package ships dist/report.js, a one-line module that issues an HTTPS POST to https://www.baidu.com carrying values read from process.env. The...

MAL-2026-4562 Malicious code in figma-d2c-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f The package ships dist/report.js, a one-line module that issues an HTTPS POST to https://www.baidu.com carrying values read from process.env. The...

iflow-mcp-kdoronin-figma-mcp (>=0.1.0, <=0.1.1), rootly-mcp-server (>=2.0.0, <=2.0.1) potentially affected by CVE-2026-32871 via fastmcp (2.4.0)

fastmcp PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - iflow-mcp-kdoronin-figma-mcp =0.1.0, =2.0.0, =2.0.1 Source cves: CVE-2026-32871 Source advisory: OSV:GHSA-VV7Q-7JX5-F767...