Malicious code in ihm-js-coral-client (npm)

The package ihm-js-coral-client was found to contain malicious code...

Malicious code in 911-js-test-example (npm)

The package 911-js-test-example was found to contain malicious code...

Malicious code in bellatrix-middleware-update-uglify-js (npm)

The package bellatrix-middleware-update-uglify-js was found to contain malicious code...

MAL-2025-23917 Malicious code in js-mods (npm)

The package js-mods was found to contain malicious code...

Malicious code in js-shq3 (npm)

The package js-shq3 was found to contain malicious code...

Malicious code in ctcommon-js (npm)

The package ctcommon-js was found to contain malicious code...

Malicious code in bigpicture-js (npm)

The package bigpicture-js was found to contain malicious code...

Malicious code in js-qha3 (npm)

The package js-qha3 was found to contain malicious code...

Malicious code in jetpack-js-tools (npm)

The package jetpack-js-tools was found to contain malicious code...

Malicious code in js-presets (npm)

The package js-presets was found to contain malicious code...

Malicious code in js-donkey (npm)

The package js-donkey was found to contain malicious code...

Malicious code in vocab-practice-js (npm)

The package vocab-practice-js was found to contain malicious code...

Malicious code in js-sja3 (npm)

The package js-sja3 was found to contain malicious code...

MAL-2025-17718 Malicious code in crpyto-js (npm)

The package crpyto-js was found to contain malicious code...

Malicious code in glints-js-sdk (npm)

The package glints-js-sdk was found to contain malicious code...

MAL-2025-27582 Malicious code in nmos-js (npm)

The package nmos-js was found to contain malicious code...

Malicious code in botbuilder-js (npm)

The package botbuilder-js was found to contain malicious code...

MAL-2025-18534 Malicious code in dme2-js-client (npm)

The package dme2-js-client was found to contain malicious code...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346: Improper Control of Generation of Code

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...