24324 matches found
MAL-2025-1198 Malicious code in worker-template-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06ee62f6404cbc2ab384a294313e49c9685b3f7a3251a4c9b86dd1d8e90dfb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1068 Malicious code in browser-sign-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6d411988c71278a3b1cc021357c555ec43f75d6834289977b60fb08c1ce8d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1157 Malicious code in onchain-summer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cfb3627a51e1629c525e521906f38f34f9ba857e21362db797959ce19749cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1200 Malicious code in worldcoin-grants-contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f434639d184713c5d345b9503077d108e6700344719b5e4825d684743661e01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in onchain-summer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cfb3627a51e1629c525e521906f38f34f9ba857e21362db797959ce19749cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in images.pages.dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 298bd92325308b96679afb4dab0afe1faeded22ac6714ac9b1a9bf0df3e6119a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1131 Malicious code in hiero-sdk-cpp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61510394f06f71bb323c3d38fbd8d57e3ac9f52dd65bf7f1054e952798c9ac39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1061 Malicious code in anyswappoc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11b4883135435c180fd5e1ec5f7f3d0ce3da30f86c240121ed36c3f2c09f1441 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1148 Malicious code in metamask-sdk-monorepo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 563827ad840866efcd9358d913c0a4e28044e336ac6d4ebc9a33c631afd70ed4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in cscvue-unplugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a34e0f08d710a6b8c04716fa45de265e2171939895e01a7d62f79cdefe72152 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in socketdinacom (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4459df3f96084582c2521387c98e79539d5c8292c2cd1834447782864728aabd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1184 Malicious code in truelayer-for-woocommerce (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b29c75990176d19762517dd4d6e52e6c8b1f434a2089b4bfc95fca56e7cd0a3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1175 Malicious code in sg_personal_ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6af0cb60de927dce01894374e1ee9541828c4fbef00917a909bbeed4275a817b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-88M4-H43F-WX84 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
Summary While rebuilding PMD Designer for Reproducible Builds and digging into issues, I found out that passphrase for gpg.keyname=0xD0BF1D737C9A1C22 is included in jar published to Maven Central. Details See...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2025-23215
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...
Cleartext Storage of Sensitive Information
Overview net.sourceforge.pmd:pmd-designer is a graphical tool that helps PMD users develop their custom rules Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the form of the passphrase for gpg.keyname=0xD0BF1D737C9A1C22 appearing in the Maven jar ...
CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...
CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...
