MAL-2025-49314 Malicious code in mbed-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e37cade9ed9f558086d52e3d4d53a6892f73d271c38ea94d5c0dd25d2a2eee32 The package mbed-js was found to contain malicious code. Source: ossf-package-analysis 09a05d2a84ef02b428f1176efd59cabf7a0b1c55bf4b0d8a2ac97c681ada2d...

Malicious code in fec-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a74bf7ef4160cbd326cf0897bab905bbc059392581da57f6b10e99471e5c60c7 The package fec-cms was found to contain malicious code. Source: ossf-package-analysis 110aae9d904f5e4469a068418b8fe0f1fdf2094e4945829b8793584539f2a9...

Malicious code in stark-recurser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54520ff73a8cd962cb9ab3db426b6c93987e6b616edf752e0e5f6f346293af1b The package stark-recurser was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-48947 Malicious code in geopost-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da57d3bad54c135655781ae00e108e90ad9a31f6eaa11327df5d4654a411f0d7 The package geopost-web-component was found to contain malicious code. Source: ghsa-malware...

Malicious code in geopost-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da57d3bad54c135655781ae00e108e90ad9a31f6eaa11327df5d4654a411f0d7 The package geopost-web-component was found to contain malicious code. Source: ghsa-malware...

MAL-2025-48949 Malicious code in test771 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39742384f3c2564e0528b3d94dc6b6cd66170e96d6a2818289c862bef030f39b The package test771 was found to contain malicious code. Source: ossf-package-analysis fbdb37fb2238599fb921d6fd14a8d65fdc19f6196377b91e304da671021e41...

Malicious code in gear-bridge-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74e84b9a555df93618c5127eddd0b90f79c79e8b54a5c60a0deb241487f867d7 The OpenSSF Package Analysis project identified 'gear-bridge-common' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...

CVE-2025-46183

The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file, deserialization may result in unintended code execution or other malicious behavior on the target system...

Securing AI Agent Execution

Large Language Models LLMs have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol MCP has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers...

MAL-2025-48547 Malicious code in stopme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c64e2664020a21b1ba2591990d854c1b1f8e37b00d8e6bc91f1e8703d5f9416 The OpenSSF Package Analysis project identified 'stopme' @ 17.0.0 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in wt-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2d85a0a81bf32d87da2b57522113cf28e122344c75d7055ea5d5116d63f61e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2022-4059

Malicious code in bioql PyPI...

MAL-2025-47899 Malicious code in @peterwiener/l (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 951ad8532d62f01f70b12691dd0d29e381cbee9f8848da6351d52ea2fc54b3a9 The OpenSSF Package Analysis project identified '@peterwiener/l' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in @peterwiener/hoodle-plugins-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d6054e60226e11fc8823a0f2c40c7e12ac3bc01084f133848165156c128e777b The OpenSSF Package Analysis project identified '@peterwiener/hoodle-plugins-manager' @ 0.5.0 npm as malicious. It is considered malicious...

Malicious code in syf-api-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a990f780ff2003775ab94c7c9d7b8cf3cf81b631fb625b0a827abd24076e9e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47232 Malicious code in @cnx-ui/cnx-ui-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87e84454809b6a23abcd234d62b4b3630bd69cf9c89b02f5e5f8c16204712981 Any computer that has this package installed or running should be considered...

MAL-2025-47105 Malicious code in threads5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8effab70875949584b7a99cee5c411c985858f88765f3301ef6621e4a609fe55 The OpenSSF Package Analysis project identified 'threads5' @ 5.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-46988 Malicious code in com.revenuecat.purchases-unity (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9409a3b3ea8cbed10c1c8e9ee79e134487117b36b0280c2190576e79e6387b60 Any computer that has this package installed or running should be considered...

Malicious code in brave-real-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec706dec762e96c2e6f2990c75a05808c5226fdd400419402135c910c5e639a5 The OpenSSF Package Analysis project identified 'brave-real-launcher' @ 1.0.10 npm as malicious. It is considered malicious because: - The packa...

MAL-2025-42142 Malicious code in brave-real-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec706dec762e96c2e6f2990c75a05808c5226fdd400419402135c910c5e639a5 The OpenSSF Package Analysis project identified 'brave-real-launcher' @ 1.0.10 npm as malicious. It is considered malicious because: - The packa...