36 matches found
GO-2026-5542 Path traversal via malicious package name in github.com/zarf-dev/zarf
A path traversal vulnerability in Zarf allows an attacker to write arbitrary files on the host system by providing a malicious package name in the package metadata. This occurs when Zarf generates SBOM or documentation outputs, or when creating a package, as it fails to properly sanitize the...
MAL-2026-5605 Malicious code in chai-as-victimed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b60cf728d4e2f5932f37d3e420649f6facc08959a8380a4724ec9e885b88754 Package name impersonates chai-as-promised but ships a remote-code dropper. lib/caller.js base64-decodes a hardcoded URL pointing to...
EUVD-2025-137390
Malicious code in imodiov-kfi-cuauscigbl npm...
Malicious code in teagood-namakai100 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dccaa29e0f3fc9808427431992e9554814af2f01a37917e0077f48835a946f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in okay_puma_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370b3da8604f6dd717ed4affc2895205c998576a74ce0f48a6528c84a5ec3f88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-49604 Malicious code in xaver-papeda69-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0375bff259864b69dce9c33b51f6092a029283021a239f65c26e0179f0fc0100 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in test-mlw1-image-hable-mayed-hance (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in xintu-yanjiushi-erlingererlingsan-erlingererlingqi (npm)
The package xintu-yanjiushi-erlingererlingsan-erlingererlingqi was found to contain malicious code...
MAL-2025-46815 Malicious code in yingyu-kouyu-xiaozhen-erlingyijiulingliu-erlingyijiulingba (npm)
The package yingyu-kouyu-xiaozhen-erlingyijiulingliu-erlingyijiulingba was found to contain malicious code...
Malicious code in @zalastax/nolb-jso- (npm)
The package @zalastax/nolb-jso- was found to contain malicious code...
Malicious code in new-al-bum-av-ailable-for-emma-forever-ago-f3oe5-dzznht (npm)
The package new-al-bum-av-ailable-for-emma-forever-ago-f3oe5-dzznht was found to contain malicious code...
Malicious code in test-mlw2-grans-botty-harps-sarge (npm)
The package test-mlw2-grans-botty-harps-sarge was found to contain malicious code...
Malicious code in test-mlw2-hammy-coaly-kilns-coifs (npm)
The package test-mlw2-hammy-coaly-kilns-coifs was found to contain malicious code...
Malicious code in test-mlw2-solus-grout-feods-menus (npm)
The package test-mlw2-solus-grout-feods-menus was found to contain malicious code...
Malicious code in wubofan-renzhi-fangfalun-erlingyibalingsi-lingliu (npm)
The package wubofan-renzhi-fangfalun-erlingyibalingsi-lingliu was found to contain malicious code...
MAL-2025-9018 Malicious code in @malware-test-totty-plouk-spats-cozed/test-mlw3-totty-plouk-spats-cozed (npm)
The package @malware-test-totty-plouk-spats-cozed/test-mlw3-totty-plouk-spats-cozed was found to contain malicious code...
MAL-2025-8688 Malicious code in @malware-test-groof-aking-pagan-games/test-mlw3-groof-aking-pagan-games (npm)
The package @malware-test-groof-aking-pagan-games/test-mlw3-groof-aking-pagan-games was found to contain malicious code...
MAL-2025-36414 Malicious code in test-mlw2-teade-thete (npm)
The package test-mlw2-teade-thete was found to contain malicious code...