MAL-2025-4423 Malicious code in tml-sso (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 847dbce1211be416799a06c22cc32901e282fd07fbb9d9b118b8763d7aa24b09 The OpenSSF Package Analysis project identified 'tml-sso' @ 10000.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-4541 Malicious code in @galaxy-nft/frontend (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf1ed32a09dd567fdadae473a43eb77d2c7e74601e2c9d136c3224813938bcb3 Any computer that has this package installed or running should be considered...

MAL-2025-4540 Malicious code in @fms-common-biz/basic-react (npm)

The package communicates with a domain associated with malicious activity...

CVE-2024-40637

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

CVE-2022-2254

A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users...

CVE-2021-29460

Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like...

MAL-2025-4583 Malicious code in vishal-plugin-flipper (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-47939

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...

When Safety Detectors Aren'T Enough: a Stealthy and Effective Jailbreak Attack on LLMs Via Steganographic Techniques

Jailbreak attacks pose a serious threat to large language models LLMs by bypassing built-in safety mechanisms and leading to harmful outputs. Studying these attacks is crucial for identifying vulnerabilities and improving model security. This paper presents a systematic survey of jailbreak method...

Are Vision-Language Models Safe in the Wild? A Meme-Based Benchmark Study

Rapid deployment of vision-language models VLMs magnifies safety risks, yet most evaluations rely on artificial images. This study asks: How safe are current VLMs when confronted with meme images that ordinary users share? To investigate this question, we introduce MemeSafetyBench, a...

Malicious code in shaktihacker (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe742c824848f300f6e3b49b60c5ccd47bb3c258769cc8444d8e87ca6a3404af Any computer that has this package installed or running should be considered...

MAL-2025-4044 Malicious code in ort-web-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3e179ffca16c7ee28162f57656f14612c34005f447e5f557edc742a4dd9120e6 The OpenSSF Package Analysis project identified 'ort-web-template' @ 100.100.1337 npm as malicious. It is considered malicious because: - The...

MAL-2025-4045 Malicious code in service-catalog-copilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89c9b90298ed452d812eb4374f8dc339318c0a084a64157722e7b733416fa131 The OpenSSF Package Analysis project identified 'service-catalog-copilot' @ 100.11.1337 npm as malicious. It is considered malicious because: -...

Malicious code in conventional-changelog-tf-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e4563668a074433d8fe6d149eeaf021077e3767d7b7b1cd5bf7825960098f937 The OpenSSF Package Analysis project identified 'conventional-changelog-tf-a' @ 100.11.1337 npm as malicious. It is considered malicious because...

MAL-2025-4042 Malicious code in conventional-changelog-tf-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e4563668a074433d8fe6d149eeaf021077e3767d7b7b1cd5bf7825960098f937 The OpenSSF Package Analysis project identified 'conventional-changelog-tf-a' @ 100.11.1337 npm as malicious. It is considered malicious because...

MAL-2025-4046 Malicious code in trusted-firmware-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a6dc31ad91aec1f31822d8aced35d9645371c5e0194f3a4b7627a6753955769 The OpenSSF Package Analysis project identified 'trusted-firmware-a' @ 100.11.1337 npm as malicious. It is considered malicious because: - The...

MAL-2025-3950 Malicious code in example-marko-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 553d816403e5dd786bafbe39f79c521cc2e5bd1917b425aefd7d5f34c96400b6 The OpenSSF Package Analysis project identified 'example-marko-webpack' @ 100.0.2 npm as malicious. It is considered malicious because: - The...

MAL-2025-3941 Malicious code in moonpay-sign (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b5de9ec184be265177d407487382fe8b9fb3b0a9b975b1d2570a06d6c054c70 Any computer that has this package installed or running should be considered...

MAL-2025-3951 Malicious code in examples-formic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 074e879e97761583a22531a3d4f917977ac387e40c36bc5eb35e3f4b367db196 The OpenSSF Package Analysis project identified 'examples-formic' @ 100.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-3957 Malicious code in vscode-oja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 222332856f685e334465b24346da36177ea57028e903aaf5c7b6fc845f1e601a The OpenSSF Package Analysis project identified 'vscode-oja' @ 100.0.2 npm as malicious. It is considered malicious because: - The package...