MAL-2025-191964 Malicious code in karemm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd5f17df1d0a4a9093ad436f4dafa59a288c2c650f7f1dff5cd36af67b5e98f The package karemm2 was found to contain malicious code. Source: ossf-package-analysis 4b8bdcb09150b560d85e5ddba2a0f76f1f26e6a330c437c93d4cd8b7560a2d...

Malicious code in karemm1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48612b0b1dd13d62c19284c76e6d5c16b29512f42c35ba20ad6243ba89c6d647 The package karemm1 was found to contain malicious code. Source: ossf-package-analysis 0f87456104eeeb78cac0cdb21d017530153ecae93b9e675b0d14f83d365c7b...

Malicious code in karem7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cdfd9c23b7a8d5b1d531b80431c97eb2b950c10d528d537fdd70ed62659d3d6 The package karem7 was found to contain malicious code. Source: ossf-package-analysis fc2e767d0dc38af90a1b88381666d2332a206a84b4d73a078ad57de5df3d708...

MAL-2025-191962 Malicious code in karem7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cdfd9c23b7a8d5b1d531b80431c97eb2b950c10d528d537fdd70ed62659d3d6 The package karem7 was found to contain malicious code. Source: ossf-package-analysis fc2e767d0dc38af90a1b88381666d2332a206a84b4d73a078ad57de5df3d708...

Malicious code in kmz1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 764e3cb5b5016e17afcd37b7b263ec2575af32008338ff14e72dd73b1d82bfa1 The package kmz1 was found to contain malicious code. Source: ossf-package-analysis 2a6ae2284037ed233d5af5263950214a55a620b61dde2f0b12669eced34b1957...

MAL-2025-191493 Malicious code in 7715-permissions-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62836f3e2abcaa4bf3bcda16aa07d57b7f0a97ffcd7d65d3ba155bfd17f8cd8c The package 7715-permissions-shared was found to contain malicious code. Source: ghsa-malware...

Malicious code in liblynxtextra.so (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0f3e98410431dc81bb4dab16130bd1e591d2f8cce684db9fb654132ce96e5fe The package liblynxtextra.so was found to contain malicious code. Source: ghsa-malware b505f2aa1ba3b64eb6dbe55e16172a887bc2b61007ef602d5bce8ce2d1ab28...

Malicious code in vitest-environment-jsdom-patched (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e0d8ae07807d73026bd13988c3341aecf8375b53ae436d03f80110884c5d84e The package vitest-environment-jsdom-patched was found to contain malicious code. Source: ghsa-malware...

Malicious code in alicenpmpackage13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4183158dd9ab68784bc126821795cf166b7f2c828d67f46efc533d3859a4342 The package alicenpmpackage13 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in node-calculator-4e41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13eeb23685dac84d542d197d77303c42cf1157c465348c204b391edca71c782d The package node-calculator-4e41 was found to contain malicious code. Source: ghsa-malware...

Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in webswing-directdraw-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e79387f18b95e5ef7af4d75095dd85e7dedcff2c1e2a068795989cc559bbc695 The package webswing-directdraw-javascript was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49306 Malicious code in sechub-openapi-ts-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbfa8eb5cccd4e8e722c4df1147efab7d4c4084b31710e417b10b87bf1d63267 The package sechub-openapi-ts-client was found to contain malicious code. Source: ghsa-malware...

Malicious code in sechub-openapi-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fa5b3dc481ba626b038be55ed5cb344e32dc983f53f2b83fc1b9f6293a3a493 The package sechub-openapi-typescript was found to contain malicious code. Source: ghsa-malware...

Malicious code in baseline-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8f0d63405c3006d5549ebf1df01f884df985fdbac7dfcc07c22c06ad556c8e The package baseline-server was found to contain malicious code. Source: ghsa-malware 2eef37dadfa82b7f47a185f272073322cc60a193be57b46387b84bbc55b3655...

CVE-2025-11989

GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions...

MAL-2025-48546 Malicious code in integration-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a2e54fa8253e6821f9fb22a4f137efeb0d32a0b8836faefa95df004781dfce8e The OpenSSF Package Analysis project identified 'integration-date' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-48528 Malicious code in canary-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74897d1cb26c40f57347ed1208575b63c7c1feb3a92ea2bef8bc84db2700bd8a The OpenSSF Package Analysis project identified 'canary-ng' @ 1337.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-48458 Malicious code in src_plugin_index_ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 396cc58d08775057aef35e59ad51a28c7379449f6f00332d193138ff8b9de09a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48437 Malicious code in hyperion-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9ccc060b3a05f5422ec317fc83c828522f43b1b0b2ce916d1c5d72bf082366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...