Malicious Package

Overview ing-feat-kyc-consent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

KYC Solutions Disclosure Information

The vulnerability of KYC Solutions’ software for customer identity verification is related to the disclosure of information in debugging messages. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose the protected information...

KYC Solutions OTP Unauthorized Access

The vulnerability of the software implementation for the KYC Solutions’ customer identity verification mechanism is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to user...

MAL-2025-192934 Malicious code in ing-feat-kyc-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33ec1565e92d1ecffd4215be59b4dbd0d6a1e91be1511dab5c9b6ece1c202507 The package ing-feat-kyc-consent was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-12239

Malicious code in bioql PyPI...

EUVD-2025-12233

Malicious code in bioql PyPI...

EUVD-2025-12234

Malicious code in bioql PyPI...

EUVD-2025-12235

Malicious code in bioql PyPI...

EUVD-2025-12237

Malicious code in bioql PyPI...

MAL-2025-47513 Malicious code in @bgrc/kyc-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 491ac58a40b45ff06a00ad44a33a15bd95394c8fde64034d150fb31433a18380 The OpenSSF Package Analysis project identified '@bgrc/kyc-theme' @ 9000.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41865 Malicious code in @espace-client-axafr/kyc-widget (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @espace-client-axafr/kyc-widget (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in kyc-sdk-javascript (npm)

The package kyc-sdk-javascript was found to contain malicious code...

MAL-2025-24847 Malicious code in kyc-sdk-javascript (npm)

The package kyc-sdk-javascript was found to contain malicious code...

CVE-2025-42604

This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to disclosure of system related...

CVE-2025-42602

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to...

CVE-2025-42600

This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password OTP attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to...

CVE-2025-42601

This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to bypassing the Captcha verification...

CVE-2025-42604

This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to disclosure of system related...

CVE-2025-42603

This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive...