CVE-2025-10016: Incorrect Authorization

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

Malicious code in random-generator-pkg (npm)

The package random-generator-pkg was found to contain malicious code...

MAL-2025-41968 Malicious code in dezelwash-pkg (npm)

The package dezelwash-pkg was found to contain malicious code...

Malicious code in dezelwash-pkg (npm)

The package dezelwash-pkg was found to contain malicious code...

MAL-2025-42061 Malicious code in random-billy-pkg (npm)

The package random-billy-pkg was found to contain malicious code...

MAL-2025-41314 Malicious code in other-pkg-b (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ab79e006d7046832f724293ad8a66618e70b615bb6e223169ac1bda1cae5d4df The OpenSSF Package Analysis project identified 'other-pkg-b' @ 99.0....

Malicious code in other-pkg-b (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ab79e006d7046832f724293ad8a66618e70b615bb6e223169ac1bda1cae5d4df The OpenSSF Package Analysis project identified 'other-pkg-b' @ 99.0....

Malicious code in dam-pkg-ckeditor (npm)

The package dam-pkg-ckeditor was found to contain malicious code...

Malicious code in pkg-sutex (npm)

The package pkg-sutex was found to contain malicious code...

MAL-2025-29351 Malicious code in pkg-dependents-cli (npm)

The package pkg-dependents-cli was found to contain malicious code...

MAL-2025-16734 Malicious code in cf-menubar-pkg (npm)

The package cf-menubar-pkg was found to contain malicious code...

Malicious code in pkg-dependents-cli (npm)

The package pkg-dependents-cli was found to contain malicious code...

MAL-2025-17938 Malicious code in dam-pkg-ckeditor (npm)

The package dam-pkg-ckeditor was found to contain malicious code...

MAL-2025-29352 Malicious code in pkg-sutex (npm)

The package pkg-sutex was found to contain malicious code...

Malicious code in external-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in internal-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in blanl-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in blank-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2f49c661af4e850b4d2aa252c5bdfc2d7409efbbae9396ac2901d0e9fc0f910 The OpenSSF Package Analysis project identified 'blank-pkg' @ 10.0.1...

CVE-2025-7464: Out-of-bounds Read

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

Malware in pkg-dev-deps-only

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...