Lucene search
+L

123678 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/23 11:00 a.m.9 views

Malicious code in fund-list-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7cde5bd15beab8488f3b3b6bde2f17fff6c148ef2d575613762f337bd1c8281 The OpenSSF Package Analysis project identified 'fund-list-filter' @ 999.9.12 npm as malicious. It is considered malicious because: - The packag...

5.3AI score
SaveExploits0
OSV
OSV
added 2026/08/23 3:11 a.m.10 views

MAL-2026-14379 Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

5.8AI score
SaveExploits0References9
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/22 8:00 p.m.9 views

Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

5.6AI score
SaveExploits0References3
OSV
OSV
added 2026/08/22 8:00 p.m.7 views

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

5.7AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/22 4:16 p.m.9 views

Malicious code in internallib_v902 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6a70573af9e288e99418e904fac717ad03d8ed270aaa9e739e42d9ec1dac962 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.6AI score
SaveExploits0References2
OSV
OSV
added 2026/08/22 12:44 a.m.15 views

MAL-2026-14357 Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.7AI score
SaveExploits0References21
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/22 12:44 a.m.12 views

Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.6AI score
SaveExploits0References21
Patchstack
Patchstack
added 2026/08/21 7:14 p.m.5 views

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

4.1CVSS5.3AI score0.00183EPSS
SaveExploits0References4Affected Software1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/21 4:53 p.m.10 views

Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

6AI score
SaveExploits0References3
OSV
OSV
added 2026/08/21 4:53 p.m.11 views

MAL-2026-14354 Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

6.2AI score
SaveExploits0References3
OSV
OSV
added 2026/08/21 1:00 p.m.9 views

ROOT-APP-NPM-CVE-2026-14620 CVE-2026-14620 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-14620 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

4.7CVSS5.4AI score0.00523EPSS
SaveExploits2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/21 11:14 a.m.8 views

Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.6AI score
SaveExploits0References4
OSV
OSV
added 2026/08/21 7:33 a.m.12 views

ROOT-APP-NPM-CVE-2026-67214 CVE-2026-67214 in nanoid - Patched by Root

Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available...

8.2CVSS5.3AI score0.0033EPSS
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/21 4:28 a.m.12 views

Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...

6.2AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/21 3:56 a.m.10 views

Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

5.6AI score
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/20 8:11 p.m.7 views

NPM: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

NPM: gettext-converter: Prototype pollution in js2i18next via crafted translation keys vulnerability discovered by ? in WordPress Npm gettext-converter versions 1.3.3...

5.2AI score
SaveExploits0References5Affected Software1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/20 6:15 p.m.8 views

Malicious code in exam-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313 On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypt...

5.5AI score
SaveExploits0References5
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/20 4:23 p.m.13 views

Malicious code in create-react-app-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.6AI score
SaveExploits0References2
Circl
Circl
added 2026/08/20 4:00 p.m.38 views

GHSA-864F-RCV7-6RH4

creationtimestamp| type| source ---|---|--- 2026-08-20 16:00:51+00:00| seen| https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html 2026-08-20 16:34:42+00:00| seen| https://bsky.app/profile/endorlabs.bsky.social/post/3mtjogb2gjk23 2026-08-21 01:00:35+00:00| seen|...

4.8AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/20 1:33 p.m.27 views

CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

8.4CVSS0.00151EPSS
SaveExploits0References3
Rows per page
Query Builder