MAL-2025-32136 Malicious code in resolvers-uglify-js-exobiology-subduction (npm)

The package resolvers-uglify-js-exobiology-subduction was found to contain malicious code...

MAL-2025-33271 Malicious code in simple-js-sha3-512 (npm)

The package simple-js-sha3-512 was found to contain malicious code...

MAL-2025-23932 Malicious code in js-sxa3 (npm)

The package js-sxa3 was found to contain malicious code...

Malicious code in simple-js-shake-128 (npm)

The package simple-js-shake-128 was found to contain malicious code...

MAL-2025-23934 Malicious code in js-wha3 (npm)

The package js-wha3 was found to contain malicious code...

Malicious code in crytpo-js (npm)

The package crytpo-js was found to contain malicious code...

Malicious code in aui-js (npm)

The package aui-js was found to contain malicious code...

MAL-2025-23930 Malicious code in js-sja3 (npm)

The package js-sja3 was found to contain malicious code...

Malicious code in common-js-support (npm)

The package common-js-support was found to contain malicious code...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346: Improper Control of Generation of Code

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

PT-2025-33143

Name of the Vulnerable Software and Affected Versions: Flowise JS affected versions not specified Description: User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host by...

CVE-2025-27388: Improper Input Validation

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

MAL-2025-6844 Malicious code in mapbox-gl-js-toys (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-54803

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

barrelly (>=1.0.0, <=1.2.0) potentially affected by CVE-2025-54803 via js-toml (1.0.0)

js-toml NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on js-toml and may be impacted: - barrelly =1.0.0, =1.2.0 Source cves: CVE-2025-54803 Source advisory: SNYK:JS-JSTOML-11483956...

CVE-2025-54803

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...