GHSA-GHCV-22JF-VFXM AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

Summary The server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink prior advisory GHSA-gph2-j4c9-vhhr, commit c08694bf6 only strips the payload when it sits under $json'msg', but the relay function msgToResourceId selects the outbound message from $msg'json' before $msg'msg'. An...

Malicious code in level-json (npm)

The package level-json was found to contain malicious code...

MAL-2025-25200 Malicious code in level-json-cache (npm)

The package level-json-cache was found to contain malicious code...

Malicious code in level-json-cache (npm)

The package level-json-cache was found to contain malicious code...

MAL-2025-25199 Malicious code in level-json (npm)

The package level-json was found to contain malicious code...

Malicious code in level-json-wrapper (npm)

The package level-json-wrapper was found to contain malicious code...

MAL-2025-25201 Malicious code in level-json-wrapper (npm)

The package level-json-wrapper was found to contain malicious code...