Malicious code in orion-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d017f02da39bfb33285066e5d65476f32d57195efe73652d4659863fe7b0367c The OpenSSF Package Analysis project identified 'orion-ui' @ 9.2.3 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41249 Malicious code in mv-hosp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4952f8c63bd825b267e27af4ca78405659c40fa6b10ed3687573b348a92c690a Any computer that has this package installed or running should be considered...

Malicious code in eslint-plugin-i18n-scan (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24f25e113ba45d8c8835196aef1b368f2a1e4fb1aecdc17e3a6d47db15371e04 The OpenSSF Package Analysis project identified...

Malicious code in commonweb-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c019e3086bf1cec9b859c8fe048187fc7cf6dc866de93fbd0ff2182b3e4fc0a The OpenSSF Package Analysis project identified 'commonweb-setup' @ 10.11.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6893 Malicious code in gen-studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 75651f44d228425603e123afc19ebe54f8701a76f7c4325cdb00545156df506a The OpenSSF Package Analysis project identified 'gen-studio' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6887 Malicious code in log4net (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a2c71f77b101535649693701491e46504cc3c34a5d35b7fa696e435f25916f2a The OpenSSF Package Analysis project identified 'log4net' @ 4.0.1 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in webflow-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 42b661acb4e76b31c10ac6138d3b67ef2606a39e5c0c291796f123ac6b232d93 The OpenSSF Package Analysis project identified 'webflow-extension' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in signup-ui-lego-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63d83acde52ca36693d2c4274687d70b0758d12141ee41ae8a97bb6e9267b983 The OpenSSF Package Analysis project identified 'signup-ui-lego-core'...

Malicious code in teste-depenconfu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 56a7fcb8d17544bc05d4a5222d7741781d9b33d6ad5d334d6c74b8851d20a257 The OpenSSF Package Analysis project identified 'teste-depenconfu' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sendbird-visual-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c99c539ebeed9289f0f603fbfe2d80bc9fe35f624bbd036ad397617db3be8de2 The OpenSSF Package Analysis project identified 'sendbird-visual-test' @ 11001.0.1 npm as malicious. It is considered malicious because: - The...

Malicious code in gsochub (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6c4ef23e2b37d9180f06b73ca4d6c919d854525b1bdf01ce97cb156df68e2c6b The OpenSSF Package Analysis project identified 'gsochub' @ 8.1.2 npm...

Malicious code in aiohappyeyeballs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2059da56cd060292843a9bf0b02a2c41b90d84e83b5b15aa59580a8bc9084a23 The OpenSSF Package Analysis project identified 'aiohappyeyeballs' @...

Malicious code in component-detection (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3a39749aff9077de404b02560689e90881fa26e3c3b9880016fb91af8700683 The OpenSSF Package Analysis project identified 'component-detection'...

z-push/z-push-dev SQL Injection Vulnerability

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...

Malicious code in package-with-conditions (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f084cb6652819e6611585205ff40b4194ebfbedb7d9a43aaaf29f0c4ac8e8828 Any computer that has this package installed or running should be considered...

Malicious code in blank-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2f49c661af4e850b4d2aa252c5bdfc2d7409efbbae9396ac2901d0e9fc0f910 The OpenSSF Package Analysis project identified 'blank-pkg' @ 10.0.1...

Malicious code in dva-loading-show-rce (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2779c32d64a46ff3b8b9de62cd9161c7b6e0071c4a3103b2a37e949f374467a0 The OpenSSF Package Analysis project identified 'dva-loading-show-rce...

MAL-2025-6221 Malicious code in creditorwatch (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8e512b66a32adafac8cde5bf65b57c17c80568658cec0a3a723b1cf9f5a46e2 Any computer that has this package installed or running should be considered...

Malicious code in donotinstallthisistest6 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 272225f1adba5810796fd9c194041e72e5fcdcc032fa296a701bcc480b37bfcb Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in @jssrv/template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce87403bb05aae59ca8877b014a3a8255b54b2a22e930687649c675cc9602f76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...