Malicious code in enum-bug-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac5c7a3ad4ff0bbfe09e6cac40b10a7e6a0c15ffb81adb37274df55278e3b4b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-261 Malicious code in woocommerce-gateway-plisio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb8f3b92cdf30ceeaf608dbfa89b7f445770f3e296b7f54fc5bec265e52ef5cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-206 Malicious code in matic-child-subgraphs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 085980a7e031404b3267eff3f19584b087b5ce5329ce9fa17265b00ef3ea2f9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in matic-child-subgraphs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 085980a7e031404b3267eff3f19584b087b5ce5329ce9fa17265b00ef3ea2f9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-184 Malicious code in enum-bug-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac5c7a3ad4ff0bbfe09e6cac40b10a7e6a0c15ffb81adb37274df55278e3b4b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-183 Malicious code in emoji-datasource-google-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3653a56d9d36fb380b98090ef118578ceed822d7bb1ab1a62d6a18fba5ed5b2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-158 Malicious code in anotherexternal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8048f8389fecd3d45d156d4fbd5dbbff5ece757ce08de730f4546368cad782b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-180 Malicious code in delegator-core-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abfbbf539b90caab925674f6beebb0623e42d576e687d703a9facfd25df6bbc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-168 Malicious code in borsh-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51f002385b3c94048b1a161d8afd15fab61c24c5e54a4a23d9020a22313bd3f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in borsh-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51f002385b3c94048b1a161d8afd15fab61c24c5e54a4a23d9020a22313bd3f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jsexports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f561855348de37f202d4723acf874ab865606f3de38f9cc4ed3d91dc415e5368 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-176 Malicious code in core-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ef412a8312b13b80beb12231488912f1488467e51c76b84f58deacd8e57488c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-161 Malicious code in as-essential (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca79d9d4238a2b341541971bce5d43c48035839588832624bb45769b20fc33e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-197 Malicious code in jazz_token-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bd3fcfec7eb7354597369d7c1b2496841dbeabc3876ca1c150802f8bc3221f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-254 Malicious code in uber-direct-js-sdk-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30ee8294ed2bcf683f478b647f9919d6b45e0651905c29ada14a3ce392168447 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hackers Deploy Malicious npm Packages to Steal Solana Wallet Keys via Gmail SMTP

Cybersecurity researchers have identified three sets of malicious packages across the npm and Python Package Index PyPI repository that come with capabilities to steal data and even delete sensitive data from infected systems. The list of identified packages is below - @async-mutex/mutex, a...

PT-2025-4848 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft CMS versions prior to 4.13.8 Craft CMS versions prior to 5.5.8 Description: This is a remote code execution RCE vulnerability that affects Craft CMS versions 4 and 5, specifically those with compromised security keys. The vulnerability...

CVE-2024-11146

TrueFiling (cloud-hosted filing system) prior to version 3.1.112.19 trusts client-controlled identifiers passed in URLs, enabling authenticated users to manipulate identifiers to gain partial access to case information and to partially change user access. The issue is a user-controlled authorizat...

CVE-2024-11146 TrueFiling authorization bypass via user-controlled keys

TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some...

TrueFiling authorization bypass via user-controlled keys

RISK EVALUATION TrueFiling trusts some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to...