MAL-2025-49004 Malicious code in firefly-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa500d2c9575be38d669c176c963359a471ba4af4853d21ba5031d9f8ed93b33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview firefly-shared-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in iot-cardboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55bbfa86675a8cd534e3602af7ba1fb1f55c45cf15c8090af9ef87542d107c2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview iot-cardboard-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview binance-connector-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-js-playwright-browserstack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious code in gear-js-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 08293e303cb9ccb253d0503e6c9a51606f052ca75e735030f6985425728f7e69 The OpenSSF Package Analysis project identified 'gear-js-util' @ 1337.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-48606 Malicious code in gear-js-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 08293e303cb9ccb253d0503e6c9a51606f052ca75e735030f6985425728f7e69 The OpenSSF Package Analysis project identified 'gear-js-util' @ 1337.1.0 npm as malicious. It is considered malicious because: - The package...

EUVD-2025-35949

Malicious code in gear-js-util npm...

EUVD-2025-35943

Malicious code in near-abi-client-js npm...

Malicious code in near-abi-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eb7fc149f977ddf35cb2a6c1bb4f3953ea99551b12cf615f9becf1778c8526f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48605 Malicious code in near-abi-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eb7fc149f977ddf35cb2a6c1bb4f3953ea99551b12cf615f9becf1778c8526f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM MQ 9.1 < 9.1.0.32 LTS / 9.2 < 9.2.0.38 LTS / 9.3 < 9.3.0.35 LTS / 9.3 < 9.4.4.0 CD / 9.4 < 9.4.0.16 LTS (7248740)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7248740 advisory. - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0. with an integer, which makes the output more predictable than...

CVE-2025-62517

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge. If application code calls rollbar.configure with untrusted input, prototype pollution is possible...

MAL-2025-48868 Malicious code in skiko-js-wasm-runtime (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in skiko-wasm-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48869 Malicious code in skiko-wasm-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48834 Malicious code in echats-js (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in echats-js (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-6833 All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aiotimeclocklitejs' AJAX action due to missing validation on a user controlled key. This makes it...