OPENSUSE-SU-2025:15654-1 git-bug-0.10.1-2.1 on GA media

These are all security issues fixed in the git-bug-0.10.1-2.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2025-33946

Malicious code in mad-1.2.5.2.2.8 npm...

OPENSUSE-SU-2025:15619-1 gitea-tea-0.11.0-2.1 on GA media

These are all security issues fixed in the gitea-tea-0.11.0-2.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2020-0922

Malware in sbrugna...

EUVD-2021-0643

Malware in sbrugna...

EUVD-2015-1580

Malware in sbrugna...

EUVD-2017-0261

Malware in sbrugna...

EUVD-2021-1216

Malware in sbrugna...

EUVD-2023-0867

Malicious code in bioql PyPI...

EUVD-2022-6225

Malicious code in bioql PyPI...

EUVD-2022-7403

Malicious code in bioql PyPI...

Malicious code in zeitwerk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acaf25aadd93141e9b88e577ad36d4e831f5fa1fbe92d0e8a97fa23404a75214 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pc-analytics-filter/core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdfc2209384455df77ab889ef6aa71c136ff6c7c2f43bb529d93568e71917d2f Any computer that has this package installed or running should be considered...

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer's account was compromised in a phishing attack. The attack targeted Josh Junon aka Qix, who received an email message that mimicked npm "[email protected]", urging them to update their update...

MAL-2025-42147 Malicious code in file-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db9d9ac2b90c17d04ff56afe81a886e99665eb55048e7cc7c9a3f0b1855db828 The OpenSSF Package Analysis project identified 'file-dependency' @ 7.0.1 npm as malicious. It is considered malicious because: - The package...

OPENSUSE-SU-2025:15528-1 python311-Django4-4.2.24-1.1 on GA media

These are all security issues fixed in the python311-Django4-4.2.24-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2025-46922 Malicious code in spamurai-dev-kit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6809fd87c593e76bcb0bd4a719cab9e51e2d3b617f9a172d0a8a2f68a09474e7 The OpenSSF Package Analysis project identified 'spamurai-dev-kit' @ 3.0.1 rubygems as malicious. It is considered malicious because: - The...

MAL-2025-41815 Malicious code in teshjsss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b7b15a769724686fbeb9dc5078008a1cd05c1c14a8b9f6de5ec415c369fbaabf The OpenSSF Package Analysis project identified 'teshjsss' @ 1337.0.0 npm as malicious. It is considered malicious because: - The package...

Use of Hard-coded Cryptographic Key

Overview Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the form of AuthSecretKey, StateSecretKey, and OAuthTokenSecretKey as defined in aes.go, which are used when generating the callback URL for OAuth authentication. Remediation Upgrade...

Malicious code in @flight-common/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10b5cb816f030297707c6e9ae79f7916de698fd58c8b068b18ef716c7425240b The OpenSSF Package Analysis project identified '@flight-common/components' @ 1.2.9213 npm as malicious. It is considered malicious because: - T...