Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

GHSA-M64Q-4JQH-F72F Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Summary A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. Poc Inserting an embed with the below url can be copy/pasted onto canvas to insert as embed will log 42 to the console:...

MAL-2022-2297 Malicious code in cxd-npm-releases (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653b5a7e3454cc87a99ebf066a86cab23a1999ba37b0cb45700df4448ebeaeef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cxd-npm-releases (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653b5a7e3454cc87a99ebf066a86cab23a1999ba37b0cb45700df4448ebeaeef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...