Malicious code in ds-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13795fdee5b77f52426cd3650250e826b6df39c418ac2956442a8016b4535e4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spiffetest.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7e0c969021c51af38deaa5a56acc3f6a7308ecf137e4051ed32c13918f6f002 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8937 Malicious code in labelv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0cda1c25c57bcf643d5f0b072d315ccff37c5423681fbd3f6f6970ab021f51a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

mautic/core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation and sanitization of user input, allowing harmful scripts to be saved and later executed in the context of other users’ sessions...

MAL-2025-4665 Malicious code in grpc-google-bigtable-v2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9640f0015404a6fff13b4e9bbb9e01d3d4f545a8ae8935dc95425a427c561576 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Harmful 'Nudify' Websites Used Google, Apple, and Discord Sign-On Systems

Single sign-on systems from several Big Tech companies are being incorporated into deepfake generators, WIRED found. Discord and Apple have started to terminate some developers’ accounts...

MAL-2025-1514 Malicious code in ninjainjtest1337 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 53b486443b3f2ffe278aa364b7455c2a522fbf1a514d4c8f70474974bf2be009 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

MAL-2024-7902 Malicious code in @taxify/react-api-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 867dfc6d0dbc4d22a2d00ebebefdb77e5203cc75ce5a803d010e5b9789f0b2b6 The OpenSSF Package Analysis project identified '@taxify/react-api-gateway' @ 10.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in quizdom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2b6e87a0fb56928d5946cb4cff73f2dd9a9ef6eda0d943f74d7f0c4333df8be0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4698 Malicious code in cugraph-dgl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c1f145fd51ee7737cb44e28b07d4ec3bfe53f4a8aac51d0b8bce58ef8bd71f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4699 Malicious code in cugraph-service-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0246f55913ed7c36615843f23e434366bb7e1491332d526c91700a891ee8fde7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4700 Malicious code in packagemurder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0245dc4dcc2cb31e6eb932d557081b0ef9dc493765b8f56d1fd61fdf70fb207a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-3278 Malicious code in subdomainer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be979ecd7261fc996ff3007675ba6e59cbdab8da999ab44c937adb5b1a609724 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-3600 Malicious code in hello-wordl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 238c137f1939d99c855ef5fedf6f16b67ac8fcd9087d80270475d3eeff8e8c65 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-3208 Malicious code in quizdom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2b6e87a0fb56928d5946cb4cff73f2dd9a9ef6eda0d943f74d7f0c4333df8be0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-1512 Malicious code in testresearchpackagedc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9a3d67880a7182900acdd5dafdb79bff126438c5538693dbd27c0c0848b2fb3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in shadycss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63b72ee48be67972ecef0ef8abb174f91a248b159d505d0cfc49975e6261dc01 The OpenSSF Package Analysis project identified 'shadycss' @ 1.0.7 npm as malicious. It is considered malicious because: - The package...

Code Injection

dbtcore is vulnerable to Code Injection. The vulnerability is due to the ability of packages to override macros, materializations, and other core components of dbt, which can allow attackers to inject harmful code...

CVE-2024-40637

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

PYSEC-2024-66

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...