Malicious code in pushlabzy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b72cad9f6511e2786488a831c354d6e529f02319374d5dc97ccfd5efaa849aa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-27844

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, macOS Sonoma 14.5, visionOS 1.2. A website's permission dialog may persist after navigation away from the site...

Malicious code in client-controls-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05882e6ffaedb0ff1165a1ab54a27887a61d76cdaf70239fe447149da971a835 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-encrypt-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a2d0ae49bf40dbf55ae8f036a2014dccfa4ad0194cebdc787acbfb69658df40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cdn-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d46d020b8f0a6ff1bcbb09ee63d0083f060a65c38e6f1d6518e860750e837544 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iterationplan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30c1be7f98eb865b7ab37c0f47fcf74149c6d9d734f558a119c77f68c686eb2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mousewhite66666 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a42a543d6a08c88dab207bc91355cd7fb9564d732b071b0ddfab43eb7f7fd5f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @shimosre/fingerprintjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ec9df2b09da9a3ea38a7df8c519df584e89f9589852834fb9736c899943936 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in solana-crypto-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb0ae4278aeded272c00f7218890bedf1e2e9dc77d03348eb4a1afe7fa277e83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in superhero-turnip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d69e2637a3683b1221571a71874774c0abaa62cd5804c7e846ab5eff6477ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helper-hoist-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d8c7136be25a9c380c74ba6c7a58d2114704c0b102b6362802aa21f7c7ee39f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ac-localnav (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3baed4fee6d491da54b31c19642059e4763ea8b9bfa42c0e8d9312ca4470016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

acme.sh 安全漏洞

acme.sh is a scripting tool in the acme.sh open source. A security vulnerability exists in versions of acme.sh prior to 40b6db6, which stems from a missing persist-credentials: false configuration in the github/workflows/dockerhub.yml file on which the Docker image is based...

PT-2025-14858 · Acme.Sh · Acme.Sh

Name of the Vulnerable Software and Affected Versions: acme.sh versions prior to 40b6db6 Description: The issue concerns a Docker image of acme.sh that is based on a .github/workflows/dockerhub.yml file. This file lacks the "persist-credentials: false" setting for actions/checkout, which may lead...

CVE-2025-32111

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout...

CVE-2025-32111

CVE-2025-32111 affects the acme.sh Docker image built from a .github/workflows/dockerhub.yml workflow. The root cause is that actions/checkout lacked persist-credentials: false, potentially exposing credentials. The provided metrics indicate high impact (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/...

Malicious code in tiktok_4d_webapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee7b2f7d0a2a643de495f8b050981233231b51ed49c2dabb3e2de7b908b9fa7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in code-tours-github (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19b52010e17d75323ff9a65a1270ecdb090b7b5d32ee461fa420cca7d237ed4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...