org.finos.legend-community:legend-delta (>=0.1.3, <=0.1.10), org.finos.legend.engine.ide.lsp:legend-engine-ide-lsp-default-extensions (>=0.6.0, <=0.34.0) +62 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.5)

net.snowflake:snowflake-jdbc MAVEN version 3.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.finos.legend-community:legend-delta =0.1.3, =0.6.0, =0.1.1, =4.29.1, =2.50.0, =2.36.0, =2.36.0,...

Malicious Package

Overview finos-legend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-47554 Malicious code in finos-legend (npm)

The package finos-legend was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d52237f76bf811889cf1da6bfa8df5deacc81e076c88890187022381ae951370 Any computer that has this package installed or running should be considered fully...

Malicious code in finos-legend (npm)

The package finos-legend was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d52237f76bf811889cf1da6bfa8df5deacc81e076c88890187022381ae951370 Any computer that has this package installed or running should be considered fully...

Malware in finos-legend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Sensitive Data Exposure

@finos/git-proxy is vulnerable to sensitive data exposure. The vulnerability is due to improper validation of commits in the pack sent to GitHub, which allows an attacker to inject unreferenced commits containing sensitive data and retrieve them via direct commit URLs without appearing in the...

Malicious File Parsing

@finos/git-proxy is vulnerable to malicious file parsing. The vulnerability is due to improper PACK signature detection in parsePush.ts, which allows an attacker to embed misleading signatures in commit content and craft packet structures to bypass approval or hide commits...

CVE-2025-54586

creationtimestamp| type| source ---|---|--- 2025-07-30 15:27:15+00:00| published-proof-of-concept| https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g...

org.finos.legend.depot:legend-depot-server (>=1.2.3, <=2.98.2), org.finos.legend.depot:legend-depot-store-server (>=1.2.3, <=2.98.2) +19 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.finos.legend.depot:legend-depot-server =1.2.3, =1.2.3, =release-4.96.3, =2.36.0, =release-4.96.3,...