MAL-2025-27784 Malicious code in november-juliet-xgdo (npm)

The package november-juliet-xgdo was found to contain malicious code...

Malicious code in dono-lumpur47-kuki (npm)

The package dono-lumpur47-kuki was found to contain malicious code...

MAL-2025-39008 Malicious code in webgldemo (npm)

The package webgldemo was found to contain malicious code...

MAL-2025-36812 Malicious code in thinatra (npm)

The package thinatra was found to contain malicious code...

MAL-2025-24364 Malicious code in kcpb (npm)

The package kcpb was found to contain malicious code...

MAL-2025-37221 Malicious code in trollshell (npm)

The package trollshell was found to contain malicious code...

Who'S the Evil Twin? Differential Auditing for Undesired Behavior

Detecting hidden behaviors in neural networks poses a significant challenge due to minimal prior knowledge and potential adversarial obfuscation. We explore this problem by framing detection as an adversarial game between two teams: the red team trains two similar models, one trained solely on...

MAL-2025-6805 Malicious code in nodejs-with-singlestore-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2dfae81e2129cf717fbae5a22ecd1938d1ea741de0968e42d5363363d6ea2dfe The OpenSSF Package Analysis project identified 'nodejs-with-singlestore-demo' @ 1002.0.1 npm as malicious. It is considered malicious because: ...

Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs

Large language models LLMs demonstrate impressive capabilities in various language tasks but are susceptible to jailbreak attacks that circumvent their safety alignments. This paper introduces Latent Fusion Jailbreak LFJ, a representation-based attack that interpolates hidden states from harmful...

MAL-2025-6804 Malicious code in sendbird-visual-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c99c539ebeed9289f0f603fbfe2d80bc9fe35f624bbd036ad397617db3be8de2 The OpenSSF Package Analysis project identified 'sendbird-visual-test' @ 11001.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-6803 Malicious code in packaging-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 343a977aea5f3758575b0bb285b1b1c6faf664546c14b1118a3b4c72798a0f55 The OpenSSF Package Analysis project identified 'packaging-common' @ 7.7.8 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6802 Malicious code in sendbird-uikit-testing-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ca3c517cac33d5fa40994b1304bd775f28b7cc7abbe7781a8f98db43839a47ab The OpenSSF Package Analysis project identified 'sendbird-uikit-testing-tools' @ 1019.0.1 npm as malicious. It is considered malicious because: ...

MAL-2025-6801 Malicious code in sendbird-notifications-extension-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db0ee25cfff1ec99d94cc0e5866df17eda725c53a92c98ce3057df8f5f23c9cc The OpenSSF Package Analysis project identified 'sendbird-notifications-extension-example' @ 1019.0.1 npm as malicious. It is considered malicio...

MAL-2025-6800 Malicious code in sendbird-docs-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6b8e9f1e70bd8605ecac970f5651ab351d6560a0001119746388c77f590ba4d4 The OpenSSF Package Analysis project identified 'sendbird-docs-validation' @ 1005.0.1 npm as malicious. It is considered malicious because: - Th...

MAL-2025-6799 Malicious code in epiro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7122f2d54ca4daac05c1acb2f7b2606264eb310be4585dc75a345a1d38ec52ab The OpenSSF Package Analysis project identified 'epiro' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

Malicious code in @evt-cdk/core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a8a0ad11a64b544d80bc12997810cd5b4bf68f64136221617a6f7d54173491f7 The OpenSSF Package Analysis project identified '@evt-cdk/core' @ 7.0...

MAL-2025-6796 Malicious code in lynx-libs-mono (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7dcde725ba12b559bfd1e62b8d6058ced4b0a5ed11b9f168f8f6f576b42ef801 The OpenSSF Package Analysis project identified 'lynx-libs-mono' @ 1.0.10 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6795 Malicious code in productboard-freemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a6e97fd17d98afb5fe43af9593d6e212069bdd9fcf008969bb1773d097e22b7 The OpenSSF Package Analysis project identified 'productboard-freemail' @ 10086.0.1113 npm as malicious. It is considered malicious because: - T...

MAL-2025-6793 Malicious code in productboard-eslint-plugin-relay (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 50a95e4b008863c195930bcd301dd1f243002839a301a5be5d0078cab7b22786 The OpenSSF Package Analysis project identified...