MAL-2025-29145 Malicious code in phoebe-vega-commitlint-config-angular-lint (npm)

The package phoebe-vega-commitlint-config-angular-lint was found to contain malicious code...

MAL-2025-9099 Malicious code in @marketing-tech/eslint-config (npm)

The package @marketing-tech/eslint-config was found to contain malicious code...

MAL-2025-20613 Malicious code in fis3-lint-eslint-umu (npm)

The package fis3-lint-eslint-umu was found to contain malicious code...

MAL-2025-25408 Malicious code in lint-slidev-fork-nebula (npm)

The package lint-slidev-fork-nebula was found to contain malicious code...

MAL-2025-28364 Malicious code in optimize-css-assets-webpack-plugin-octans-eslint-config-farout (npm)

The package optimize-css-assets-webpack-plugin-octans-eslint-config-farout was found to contain malicious code...

MAL-2025-9594 Malicious code in @vikas_upadhyay0/swagger-lint (npm)

The package @vikasupadhyay0/swagger-lint was found to contain malicious code...

MAL-2025-25409 Malicious code in lint-staged-ceres-metalsmith-non-blocking (npm)

The package lint-staged-ceres-metalsmith-non-blocking was found to contain malicious code...

MAL-2025-22351 Malicious code in heka-native-frontend-lint-staged (npm)

The package heka-native-frontend-lint-staged was found to contain malicious code...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via improper validation when parsing Chart.yaml and index.yaml files. An attacker can cause a panic in the application by providing malformed or unexpected YAML content, such as a null maintainer, non-strin...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via improper validation when parsing Chart.yaml and index.yaml files. An attacker can cause a panic in the application by providing malformed or unexpected YAML content, such as a null maintainer, non-strin...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via improper validation when parsing Chart.yaml and index.yaml files. An attacker can cause a panic in the application by providing malformed or unexpected YAML content, such as a null maintainer, non-strin...

SUSE-SU-2025:02592-1 Security update for cosign

This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: - Add signing-config create command 4280 - Allow multiple services to be specified for trusted-ro...

Malicious code in lint-staged-custom (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6630 Malicious code in lint-staged-custom (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lint-pr-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a7398205d96f4d045fedf2fbd41ba545c40048a2e9683747ab8bec7ac77a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6177 Malicious code in lint-pr-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a7398205d96f4d045fedf2fbd41ba545c40048a2e9683747ab8bec7ac77a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-53546 Folo allows secrets exfiltration via `pull_request_target`

Folo organizes feeds content into one timeline. Using pullrequesttarget on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets from the base repo. By exploiting the vulnerability is possible to...

GHSA-FV92-FJC5-JJ9H vulnerabilities

Vulnerabilities for packages: dataplaneapi-fips, opentelemetry-operator, conftest, pgtimetable, thanos, steampipe, nerdctl, spire-server-fips, spark-operator-fips, trivy-operator, spire-server, jitsucom-bulker, kyverno-policy-reporter-fips, opentelemetry-collector, timestamp-authority-fips,...

Malicious code in k8s-lint-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b445cff5be01caddf1be7a89f1cea09fce4135e635b83655ff150c35b8940e86 Any computer that has this package installed or running should be considered...

MAL-2025-4566 Malicious code in k8s-lint-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b445cff5be01caddf1be7a89f1cea09fce4135e635b83655ff150c35b8940e86 Any computer that has this package installed or running should be considered...