MAL-2025-191207 Malicious code in @commute/bloom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72a8d3f37c021b587ff0a29256071f77c00a9cd9c0ac896a95eadefc849dba2f The package @commute/bloom was found to contain malicious code. Source: ghsa-malware f0fc74d77b27b5b9dd2fea4b44706142694d54536db65dad741286d4c1653ca3...

MAL-2025-190645 Malicious code in @posthog/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92317c7f15a5eade85fe5c248b9b31870be1b384a5e5455dd3ea546c94c279e4 The package @posthog/core was found to contain malicious code. Source: ghsa-malware 8fce4f3a908b835a108ad8c30d1f2095f67e065911b353c73d0f9151be9ed6bf...

MAL-2025-47294 Malicious code in airchief (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d27bcc3bc35dd516704520eaafbd086947c4ca78d0f28945786da155acc1a73 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47284 Malicious code in @tnf-dev/api (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b9e8e4fdb36ce27b5711a81c3639dcea62b2982fac039847b621e5354efa762 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47262 Malicious code in @operato/shell (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21ac476a02ea2559959f2fb9a0811fd56ee2380dfc7bd199f7731e350b5899ad Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47140 Malicious code in @ctrl/shared-torrent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24fa569db2913c10f73f32aa003c6ffa19fdd3f8883d9ba4795eb72a6b1cfc9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know

Detect and mitigate a critical supply chain compromise affecting the Nx NPM Package. Organizations should act urgently...

xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs

An employee at Elon Musk's artificial intelligence company xAI leaked a private key on GitHub that for the past two months could have allowed anyone to query private xAI large language models LLMs which appear to have been custom made for working with internal data from Musk's companies, includin...

GO-2025-3529 Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive

Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive...

GO-2022-0381 Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server

Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server...

EleKtra-Leak Cryptojacking Attacks Exploit AWS IAM Credentials Exposed on GitHub

A new ongoing campaign dubbed EleKtra-Leak has set its eyes on exposed Amazon Web Service AWS identity and access management IAM credentials within public GitHub repositories to facilitate cryptojacking activities. "As a result of this, the threat actor associated with the campaign was able to...

The Rising Threat of Secrets Sprawl and the Need for Action

The most precious asset in today's information age is the secret safeguarded under lock and key. Regrettably, maintaining secrets has become increasingly challenging, as highlighted by the 2023 State of Secrets Sprawl report, the largest analysis of public GitHub activity. The report shows a67%...

CVE-2019-14957

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vimsettings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository...

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...