MAL-2025-1452 Malicious code in yizhifabao58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ced901d0e5c904cb9495a0a9f7f06831e23fb03344b950107899ac7e8f8f00f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telegram-bots (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce26b83a8f4eda763f723d82a057158e8b6265de39b789ca17e5d38884401cf8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telegram-bot-hoster (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b1f6f7d44822f546914ae3155fe660229e8ccb900d78e88fe8dfa32aa1ae90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the HS256 algorithm implementation in the Knowledge Space integrated planning platform lies in the use of weak credentials. This allows a hacker to gain full access to the platform.

The vulnerability of the HS256 algorithm implementation in the Knowledge Space integrated planning platform lies in the use of weak authentication data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the platform...

WordPress FULL – Cliente plugin <= 3.1.26 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin FULL Customer versions = 3.1.26...

CVE-2024-13539

The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-interface/phpunit.php file being publicly accessible and displaying error messages. This makes it possible for unauthenticated attackers to...

Malicious code in vidio-kmm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e504408eb9deb6119908874c0e0d1a2ed179bfe908a21a8f42d8296ede12dbc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1372 Malicious code in osae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a2bd262915382cb128bb666e68b026eba1833defef6743b4def27e204a71d74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jbrowse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718122d6ef307a963a9df00b5272528ab1af438eb21e93463a4fec2fb65e70ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uzx-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7250eab0a6f8a7fb2b339d8b38fdfeacce4a669afd92b62c4f271d460973faf Any computer that has this package install...

Malicious code in deepcoin (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15b2b0a1de9fc578353fa42931500e9358f9f0e40ea85115efd8d0e583832e1c Any computer that has this package install...

Malicious code in deepcoin-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f03ef4f8a77536dbc09bc7dc855b7b176153e3f037ea6eedf02d2ec74f9cbed9 Any computer that has this package install...

Malicious code in bitflyer-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92823aff4557314ac33ae517e80618531108f8df36c4abf480745cbdf92462a8 Any computer that has this package install...

Malicious code in gemini-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b876a5257a85fe7e175269384da4a6acc19851e9b43c4d6be807d7dc78c692e Any computer that has this package install...

Malicious code in bitmart-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69812f8747387682581f0dd9ddbb41055fe07020e94fcbeb5b3f8ca68f745a11 Any computer that has this package install...

Malicious code in bitmart-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d7b17d0b3d6588bf3a32a7009090523626ba7ed46d99dbefe9405ed04b7bdf3 Any computer that has this package install...

Malicious code in lbank-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 478503c4a1ca3df17a3afbdbb8c6cf693d2a76bfba2dc8a30d55a86eb1ac0b19 Any computer that has this package install...

Malicious code in crypto-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03333e75c4b6ad776d7e7e5242030adf8dc36c5a4df0f10802c33bff345516d6 Any computer that has this package install...

Malicious code in bingx-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74fed3b365bba4b23023b9ba3b67bc1e9586827a59b58d4b8d3861633802fa4c Any computer that has this package install...

Malicious code in gate-production (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e5829c327248d41abf070c9c23598e436a2fefc55efc2986ff6ca1ba771ef61 Any computer that has this package install...