MAL-2025-49030 Malicious code in polyfill-regenerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7d3f5ade208f63787145ecad7643a32b6bf4525494a136967abcd7d0ba2e720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a2dc971622a44de97536e68fb7287ef32a7a1bdabe0d0386eadf248219cea54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48993 Malicious code in durablefunctionsmonitor-vscodeext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0bcd6dd0f47781eb145c4a57e94a505ad8fe070437e096926c7c5a7601087b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-49063 Malicious code in ul-inline (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15d6bb031b2303d28ce8296da9c8f534d9576044e57faffcf455a70b24aa6b9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jfrog-npm-actions-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a600f48287c23fcb6db85ed0ed084de6ce12d7d3fab99e327ec306c6a84ea7f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in airbnb-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bdd7ff1ebc82ab66444ee41ee81408d4c29440e9a5662b9d11c4734d8a3a0c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48995 Malicious code in elemefe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcbb1237331b1e8b0d21101d938aba8142d3d16132e181b92f0a2d91b389e90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ucbuzz-web-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 822537afdb770182527cdfc92395d4fcc57ab88a98e6958ba68f93eb84f119ef The package ucbuzz-web-common was found to contain malicious code. Source: ghsa-malware...

Malicious code in ft-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c048d30efedaea5fdd0efeaa12f5ac0fc2498a9a3ff8698af6c96566e5542825 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-49024 Malicious code in named-asset-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41aa2c9de0b9bf1fc5a9cbee9d0442255a36d349e4645660908d01b2ac8db820 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-ipack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04968f8d37cfe2848c6e84c9c09a994da049651043da1015e31963470062395a The package react-ipack was found to contain malicious code. Source: ghsa-malware 3411c0f05536a691b48437d34b83198f786eb7a2d19d27a5c4555ac397d5a927 An...

Malicious code in graphnet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022ef4190a3153420248771034a085983347a98a7bbd3be8ce4eaf80b0d0dfd8 The package graphnet was found to contain malicious code. Source: ghsa-malware f027c14837595ab3595469caa7197e8cdf4f3288a53a4c1fbf970cbb7cd6018d Any...

MAL-2025-48935 Malicious code in shopify-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974d73b54aa22ffaf8dfee7094b175bea558642ea43dda60cee5bc58b44ed17f The package shopify-ruby was found to contain malicious code. Source: ghsa-malware a529d693e0fe4a67a348d26b2117b4b314994f3378fa0ed92576c915cd5dccff A...

Malicious code in vite-manual-chunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2466db729b423d58b084a5f99834cfaf8c62af4179350ef30978e32f36b50fa7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48580 Malicious code in node-get-listener (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bac8d13d5bfac4dd2762c47c3c87beec273f4f7481b6d8b5d405bc5d5a9fa3f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in useradm-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce2bcbfbdffbf03bd25822f3d63f902505a6edc5efb3ef610fce41007b8620b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deployments-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ba6d5d2de9ef4fd28b80daa2474015f2574ae70d3ccb9ea5c41c73c2f846bda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-62688 AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to change their role, gaining full control access to the project...

AutomationDirect Productivity Suite

RISK EVALUATION Successful exploitation of these vulnerabilities could enable an attacker to execute arbitrary code, disclose information, gain full-control access to projects, or obtain read and write access to files. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

CVE-2025-41108 Improper Authentication vulnerability in Ghost Robotics' Vision 60

The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station tablet and gaining unauthorised full control of the robot. The absence of encryption and authenticati...