MAL-2024-7902 Malicious code in @taxify/react-api-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 867dfc6d0dbc4d22a2d00ebebefdb77e5203cc75ce5a803d010e5b9789f0b2b6 The OpenSSF Package Analysis project identified '@taxify/react-api-gateway' @ 10.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in quizdom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2b6e87a0fb56928d5946cb4cff73f2dd9a9ef6eda0d943f74d7f0c4333df8be0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-3278 Malicious code in subdomainer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be979ecd7261fc996ff3007675ba6e59cbdab8da999ab44c937adb5b1a609724 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-1512 Malicious code in testresearchpackagedc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9a3d67880a7182900acdd5dafdb79bff126438c5538693dbd27c0c0848b2fb3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4698 Malicious code in cugraph-dgl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c1f145fd51ee7737cb44e28b07d4ec3bfe53f4a8aac51d0b8bce58ef8bd71f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4700 Malicious code in packagemurder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0245dc4dcc2cb31e6eb932d557081b0ef9dc493765b8f56d1fd61fdf70fb207a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-3600 Malicious code in hello-wordl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 238c137f1939d99c855ef5fedf6f16b67ac8fcd9087d80270475d3eeff8e8c65 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-3208 Malicious code in quizdom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2b6e87a0fb56928d5946cb4cff73f2dd9a9ef6eda0d943f74d7f0c4333df8be0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4699 Malicious code in cugraph-service-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0246f55913ed7c36615843f23e434366bb7e1491332d526c91700a891ee8fde7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in shadycss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63b72ee48be67972ecef0ef8abb174f91a248b159d505d0cfc49975e6261dc01 The OpenSSF Package Analysis project identified 'shadycss' @ 1.0.7 npm as malicious. It is considered malicious because: - The package...

Code Injection

dbtcore is vulnerable to Code Injection. The vulnerability is due to the ability of packages to override macros, materializations, and other core components of dbt, which can allow attackers to inject harmful code...

CVE-2024-40637

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

PYSEC-2024-66

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

CVE-2024-40637 Implicit override for built-in materializations from installed packages in dbt-core

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

CVE-2024-40637 Implicit override for built-in materializations from installed packages in dbt-core

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

CVE-2024-40637

CVE-2024-40637 affects dbt-core where installing a package can override macros, materializations, and other core components, potentially allowing malicious packages to inject harmful code. Root cause: implicit override of built-in materializations from installed packages. Impact is described as h...

Malicious code in moti-dep-con-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5bc71f5232122aed2afbe9d2cf3ba2af4b88c9daf47d5dd53be1010621e218c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sap-boards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f03ca612a15163c77abfa2590e258d664e33bc5d26670a73d6affe79ae0c8b7 The OpenSSF Package Analysis project identified 'sap-boards' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7667 Malicious code in sap-categoryid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5a2fe1c470d8ba6b59f035e8e12de6301dcfa748ec23614655546bbfae264053 The OpenSSF Package Analysis project identified 'sap-categoryid' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-authenticate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4011b4682df361885068a85fb964ef88af5e0fd77d05306416b10e10c5cb9b6e The OpenSSF Package Analysis project identified 'sap-authenticate' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...