MAL-2025-4839 Malicious code in jsons-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c23d84cb2201d919fefd3fa95fc777c80ed4adbb5e2fc87e1e1430bcb6edab6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4874 Malicious code in react-query-persist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 510db02a90f329eb7d168ccd3c9ae2f89d81e24f4dae93823b0b1fdac4bf2256 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4868 Malicious code in pyiceberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5fa44fe907854125c2e5e5ebed5ecc53ad3578ce319bfdf5a92524c65793185 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4859 Malicious code in ohhttpstubs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 642efaac1637742aa2d3755af417f202219293d844b0c0ec46300fa7fdfaf046 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dpts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f18dd94071e8740ce21a5f0aa3abd080e376fc53065d5f7d99b2edb87c46a09e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4817 Malicious code in boost-static-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ea6d07c816f16b0ce7ce7e7b952fa013034be54604e072cd3c500d9cc75e48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-appstore-server-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ffc44075c7a6123e6fd516c9e8c1abbd98b481d26ae67ee10e814bec86bbe7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4812 Malicious code in apple-appstore-server-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ffc44075c7a6123e6fd516c9e8c1abbd98b481d26ae67ee10e814bec86bbe7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 41 : krb5 (2025-42a13f896e)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-42a13f896e advisory. Disallowing use of the arcfour-hmac-md5 encryption type for session keys Add support for the PKINIT paChecksum2 sequence, required for Active Directory...

PT-2025-25171 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.10.0.0 through 4.20.0.0 Description: A privilege escalation issue exists where a malicious Domain Admin user in the ROOT domain can obtain the API key and secret key of user-accounts of Admin role type in the same...

Lightweight and High-Throughput Secure Logging for Internet of Things and Cold Cloud Continuum

The growing deployment of resource-limited Internet of Things IoT devices and their expanding attack surfaces demand efficient and scalable security mechanisms. System logs are vital for the trust and auditability of IoT, and offloading their maintenance to a Cold Storage-as-a-Service Cold-STaaS...

AMD EPYC 安全漏洞

AMD EPYC is an x86 architecture server microprocessor product line from AMD, known as "Xiao Long" in Chinese, which utilizes the Zen microarchitecture. A security vulnerability exists in AMD EPYC that stems from improper register access control, which could allow a privileged attacker to gain...

GFI Archiver 信任管理问题漏洞

GFI Archiver is an e-mail archiving software from GFI, Inc. for protecting, storing and retrieving your electronic communications. GFI Archiver suffers from a trust management issue vulnerability that stems from hard-coding JWT signing keys, which could lead to unauthorized access...

GHSA-FJ44-H6XW-896G react-native-keys insecurely stores encryption cipher and Base64 chunks

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...

CVE-2025-45001

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...

MAL-2025-4755 Malicious code in npm-events-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 124e786a3d3278c67bf1ecc9036c8ed825bf1900876aa41cc7661074c919cde4 Any computer that has this package installed or running should be considered...

MAL-2025-4749 Malicious code in keepachangelog-manager (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7624090c3cb084270916fc61df883fbbbed216ad3a9c6133425e1d39d682e50 Any computer that has this package installed or running should be considered...

npm react-native-keys 安全漏洞

npm react-native-keys is a mobile environment variable security library from US-based npm. A security vulnerability exists in npm react-native-keys version 0.7.11, which stems from encrypted passwords and Base64 blocks being stored in plaintext in compiled native binaries, potentially leading to...

CVE-2025-45001

CVE-2025-45001 affects react-native-keys 0.7.11. The issue is that encryption cipher data and Base64 chunks are stored as plaintext in the compiled native binary, enabling leakage of secrets through basic static analysis. Documents consistently describe this as a remote information-disclosure vul...

CVE-2025-45001

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...