EUVD-2025-178864

Malicious code in fork-eslint-slidev-chakra-ui npm...

EUVD-2025-178858

Malicious code in fork-webpack-kastra-chai npm...

EUVD-2025-113525

Malicious code in fork-eslint-plugin-procyon-fusion npm...

EUVD-2025-113517

Malicious code in fork-publish-node-config-mini-css-extract-plugin npm...

MAL-2025-142603 Malicious code in fork-writable-miranda-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2c06e94df0ee3bbe0de2fafb23ce4891a4357d3007dc2d8241ab688d448ba3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-achernar-fork-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92b8f8c34cd0569e980d0406ca537a6f31f0966e068ac568d2797b35fc517fbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-72608 Malicious code in dono-oblok5-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74081e636c233358f61ebd3507690776df36526469ffbe46bd6200bdbf8d2c1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Chasing One-Day Vulnerabilities across Open Source Forks

Tracking vulnerabilities inherited from third-party open-source components is a well-known challenge, often addressed by tracing the threads of dependency information. However, vulnerabilities can also propagate through forking: a repository forked after the introduction of a vulnerability, but...

Gathers structured vuln data from plugins that fork

This plugin generates internal host tags for vulnerability data from plugins that fork. It queries scratchpad tables, aggregates the vulnerability data by plugin ID, port and protocol, then attaches the data to the scan as internal host tags. This plugin does not create a scan vulnerability repor...

EUVD-2025-25611

Malicious code in bioql PyPI...

MAL-2025-44287 Malicious code in fork-superflare-multiverse-spectron (npm)

The package fork-superflare-multiverse-spectron was found to contain malicious code...

MAL-2025-41618 Malicious code in aiohttp-proxies-forked (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aiohttp-proxies-forked (PyPI)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-55398

The mouse07410 asn1c tool (a fork of vlm asn1c) is vulnerable in versions through 0.9.29 (2025-03-20). In UPER (Unaligned Packed Encoding Rules), the tool fails to enforce INTEGER constraints when the positive bound exceeds 32 bits in length. This flaw allows for the processing of incorrect or ma...

MAL-2025-32621 Malicious code in sagemaker-forked-extensions (npm)

The package sagemaker-forked-extensions was found to contain malicious code...

Malicious code in sagemaker-forked-extensions (npm)

The package sagemaker-forked-extensions was found to contain malicious code...

CVE-2025-53637 Meshtastic allows Command Injection in GitHub Action

Meshtastic is an open source mesh networking solution. The mainmatrix.yml GitHub Action is triggered by the pullrequesttarget event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part,...

CVE-2025-2886

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough...

CVE-2024-4254

The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization. The vulnerability arises from the workflow's explicit checkout and execution of code from a fork, which is unsafe as it...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...