MAL-2025-192817 Malicious code in jz-native-js-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be9f16b75f7bf0ca5477443252a99142fcc146e923a7f77862df124ad6ac5 The package jz-native-js-bridge was found to contain malicious code...

SUSE CVE-2025-64718

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

Security Bulletin: Components with known vulnerabilities in IBM Security QRadar Analyst Workflow for IBM QRadar SIEM

Summary Multiple components with known vulnerabilities were addressed in a IBM Security QRadar Analyst Workflow for IBM QRadar SIEM release Vulnerability Details CVEID:CVE-2025-64756 DESCRIPTION: Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions...

EUVD-2025-204549

Malicious code in sonia3-npm-js npm...

MAL-2025-192670 Malicious code in sonia3-npm-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 339534853ebcb623a903a0515ab9ae854edaac8fdfec58d3edb454c501238d19 The package sonia3-npm-js was found to contain malicious code. Source: ghsa-malware 3b951ad6a6c46f78a032c0c93db496b6b13cfadccf178f195cd6c3f28531ed1e...

Malicious code in sonia3-npm-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 339534853ebcb623a903a0515ab9ae854edaac8fdfec58d3edb454c501238d19 The package sonia3-npm-js was found to contain malicious code. Source: ghsa-malware 3b951ad6a6c46f78a032c0c93db496b6b13cfadccf178f195cd6c3f28531ed1e...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell: CVE-2025-55182 – Comprehensive Vulnerability Scan...

Next.js Framework React Server Components DoS (CVE-2025-55184)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages:...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +24466 more potentially affected by CVE-2025-68161 via org.apache.logging.log4j:log4j-core (>=2.0-beta9, <=2.25.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-beta9, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2025-68161 Source advisory: OSV:GHSA-VC5P-V9HR-52MJ...

EUVD-2025-203878

Malicious code in vitor-js npm...

Malicious Package

Overview vitor-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in vitor-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bd6760c1b98479c10035033bae4ed585e80c762bf7fd4c79d45bdc990a852e The package vitor-js was found to contain malicious code. Source: ghsa-malware 59962d3857dd8e503c596b43fbb33337d27bea7c1f53e69a305e690913599163 Any...

MAL-2025-192603 Malicious code in vitor-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bd6760c1b98479c10035033bae4ed585e80c762bf7fd4c79d45bdc990a852e The package vitor-js was found to contain malicious code. Source: ghsa-malware 59962d3857dd8e503c596b43fbb33337d27bea7c1f53e69a305e690913599163 Any...

Malicious Package

Overview template-vue-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

UBUNTU-CVE-2025-68154

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the fsSize function in systeminformation is vulnerable to OS command injection on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without...

Malicious code in dubbo-js-private-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7718e849fa01a112b317438650757b783681fbb3361ec73154005719f6f892 The package dubbo-js-private-workspace was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192586 Malicious code in dubbo-js-private-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7718e849fa01a112b317438650757b783681fbb3361ec73154005719f6f892 The package dubbo-js-private-workspace was found to contain malicious code. Source: ghsa-malware...

Withdrawn Advisory: LikeC4 has RCE through vulnerable React and Next.js versions

Withdrawn Advisory This advisory has been withdrawn because LikeC4 isn’t impacted by CVE-2025-55182 because it doesn’t ship React. React is a peer dependency. Original Description LikeC4 uses React and Next.js: which contain known RCE vulnerabilities, as seen in CVE-2025-55182. 2025-12-15 Edit: t...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell CVE-2025-55182 — Local RSC Security Demo ⚠️ W...

Malicious Package

Overview @revvity-signals/chemdraw-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...