org.finos.legend-community:legend-delta (>=0.1.3, <=0.1.10), org.finos.legend.engine.ide.lsp:legend-engine-ide-lsp-default-extensions (>=0.6.0, <=0.34.0) +62 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.5)

net.snowflake:snowflake-jdbc MAVEN version 3.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.finos.legend-community:legend-delta =0.1.3, =0.6.0, =0.1.1, =4.29.1, =2.50.0, =2.36.0, =2.36.0,...

MAL-2025-47554 Malicious code in finos-legend (npm)

The package finos-legend was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d52237f76bf811889cf1da6bfa8df5deacc81e076c88890187022381ae951370 Any computer that has this package installed or running should be considered fully...

Malware in finos-legend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview finos-legend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in finos-legend (npm)

The package finos-legend was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d52237f76bf811889cf1da6bfa8df5deacc81e076c88890187022381ae951370 Any computer that has this package installed or running should be considered fully...

org.finos.legend.depot:legend-depot-server (>=1.2.3, <=2.98.2), org.finos.legend.depot:legend-depot-store-server (>=1.2.3, <=2.98.2) +19 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.finos.legend.depot:legend-depot-server =1.2.3, =1.2.3, =release-4.96.3, =2.36.0, =release-4.96.3,...