1533 matches found
MAL-2026-7935 Malicious code in lbmtq5x (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lblzhhumah (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lambx5283681 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in hrab4 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in grax0 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in enc30654 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7618 Malicious code in dlxprobe1 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in civic-test-scrape (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
ROOT-APP-PYPI-CVE-2025-5279 CVE-2025-5279 in rootio-redshift-connector - Patched by Root
Root has patched CVE-2025-5279 in the rootio-redshift-connector package for Root:PyPI. Multiple fixed versions available...
Malicious Package
Overview @cloudplatform-single-spa/enterprise is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...
Malicious code in weavedb-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 886f22636b5e4726978e23b10a4311fb7e65c2b10003da72429348fa617884d1 package.json declares "preinstall": "./vendor/setup", which runs a 976KB packed Linux x86 ELF binary sha256...
Malicious code in class-weaver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4e45cdd0a93db2db56ae7fd2c348305a5ce7aeab9c6fb4b2331c2a547b2c5e7 class-weaver advertises itself as a className/theme utility keywords clsx, utils, styling; exports named classNames and twMerge mimicking...
Astra Linux – Vulnerability in Node-EJS
The ejs also known as Embedded JavaScript templates package in Node.js before version 3.1.10 lacked certain measures to prevent pollution...
Malicious code in glass-of-water (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df79336313f71fac8158ff6f3e0160d0e99a8d1d84c452505fd3739af5838a69 glassofwater/init.py embeds 10 Google Gemini API keys AIzaSy... split across 5-part dictionaries and reassembled at runtime by getapikey L6-19. The...
Malicious code in venturo-playwright-runner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e63f5fe21c0fe70b9b120a217b3d1b14e765c47de231eb03d0d763c471fbd4e The package republishes Microsoft's @playwright/test under the unrelated name venturo-playwright-runner and falsifies its identity to claim Microsoft...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...
CLEANSTART-2026-MP82813 Security fixes for CVE-2026-33186, CVE-2026-39882, CVE-2026-39883, CVE-2026-40179, ghsa-mqqf-5wvp-8fh8 applied in versions: 1.21.0-r0, 1.21.0-r1
Multiple security vulnerabilities affect the cortex package. These issues are resolved in later releases. See references for individual vulnerability details...
NPM: vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
NPM: vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.5...
