Malicious code in personal-api (npm)

The package personal-api was found to contain malicious code...

MAL-2025-29080 Malicious code in personal-api (npm)

The package personal-api was found to contain malicious code...

Authentication flaw

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication e.g., GitHub or Google SSO in an organization that also allows password authentication could have their personal API key stolen by an...