MAL-2025-4554 Malicious code in cspotcode (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2130be6b5e619ba165a6aece5d32fbf21121d999dea65d83d80d4464db4b1ce Any computer that has this package installed or running should be considered...

Phare: a Safety Probe for Large Language Models

Ensuring the safety of large language models LLMs is critical for responsible deployment, yet existing evaluations often prioritize performance over identifying failure modes. We introduce Phare, a multilingual diagnostic framework to probe and evaluate LLM behavior across three critical...

MAL-2025-4424 Malicious code in @cat-ecom/pcc-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 96cbe81d68d4bf1046012598de37b5dcef6f28b3ce01653ab29b3405b359d30e The OpenSSF Package Analysis project identified '@cat-ecom/pcc-components' @ 99.99.99 npm as malicious. It is considered malicious because: - Th...

MAL-2025-4423 Malicious code in tml-sso (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 847dbce1211be416799a06c22cc32901e282fd07fbb9d9b118b8763d7aa24b09 The OpenSSF Package Analysis project identified 'tml-sso' @ 10000.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-4541 Malicious code in @galaxy-nft/frontend (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf1ed32a09dd567fdadae473a43eb77d2c7e74601e2c9d136c3224813938bcb3 Any computer that has this package installed or running should be considered...

MAL-2025-4540 Malicious code in @fms-common-biz/basic-react (npm)

The package communicates with a domain associated with malicious activity...

CVE-2024-40637

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

CVE-2022-2254

A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users...

CVE-2021-29460

Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like...

MAL-2025-4583 Malicious code in vishal-plugin-flipper (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-47939

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...

When Safety Detectors Aren'T Enough: a Stealthy and Effective Jailbreak Attack on LLMs Via Steganographic Techniques

Jailbreak attacks pose a serious threat to large language models LLMs by bypassing built-in safety mechanisms and leading to harmful outputs. Studying these attacks is crucial for identifying vulnerabilities and improving model security. This paper presents a systematic survey of jailbreak method...

Are Vision-Language Models Safe in the Wild? A Meme-Based Benchmark Study

Rapid deployment of vision-language models VLMs magnifies safety risks, yet most evaluations rely on artificial images. This study asks: How safe are current VLMs when confronted with meme images that ordinary users share? To investigate this question, we introduce MemeSafetyBench, a...

Malicious code in shaktihacker (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe742c824848f300f6e3b49b60c5ccd47bb3c258769cc8444d8e87ca6a3404af Any computer that has this package installed or running should be considered...

MAL-2025-4044 Malicious code in ort-web-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3e179ffca16c7ee28162f57656f14612c34005f447e5f557edc742a4dd9120e6 The OpenSSF Package Analysis project identified 'ort-web-template' @ 100.100.1337 npm as malicious. It is considered malicious because: - The...

MAL-2025-4045 Malicious code in service-catalog-copilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89c9b90298ed452d812eb4374f8dc339318c0a084a64157722e7b733416fa131 The OpenSSF Package Analysis project identified 'service-catalog-copilot' @ 100.11.1337 npm as malicious. It is considered malicious because: -...

MAL-2025-4042 Malicious code in conventional-changelog-tf-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e4563668a074433d8fe6d149eeaf021077e3767d7b7b1cd5bf7825960098f937 The OpenSSF Package Analysis project identified 'conventional-changelog-tf-a' @ 100.11.1337 npm as malicious. It is considered malicious because...

Malicious code in conventional-changelog-tf-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e4563668a074433d8fe6d149eeaf021077e3767d7b7b1cd5bf7825960098f937 The OpenSSF Package Analysis project identified 'conventional-changelog-tf-a' @ 100.11.1337 npm as malicious. It is considered malicious because...

MAL-2025-4046 Malicious code in trusted-firmware-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a6dc31ad91aec1f31822d8aced35d9645371c5e0194f3a4b7627a6753955769 The OpenSSF Package Analysis project identified 'trusted-firmware-a' @ 100.11.1337 npm as malicious. It is considered malicious because: - The...

MAL-2025-3950 Malicious code in example-marko-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 553d816403e5dd786bafbe39f79c521cc2e5bd1917b425aefd7d5f34c96400b6 The OpenSSF Package Analysis project identified 'example-marko-webpack' @ 100.0.2 npm as malicious. It is considered malicious because: - The...