MAL-2025-47197 Malicious code in ngx-bootstrap (npm)

The package ngx-bootstrap was found have been identified as potentially malicious due to the inclusion of a minified postinstall script. It is considered suspicious because: The script appears to attempt to steal access tokens for npm, GitHub, AWS, GCP, etc. There is no changelog or new tags in t...

CVE-2025-58374

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

CVE-2025-58374

Summary (CVE-2025-58374): Roo Code versions 3.25.23 and earlier allow an auto-approved npm install that can execute a repository’s postinstall script, enabling arbitrary code execution. Root cause: npm install is in the default auto-approve list, so malicious postinstall scripts run without user ...

PT-2025-36345

Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.25.23 and below Description: Roo Code is an AI-powered autonomous coding agent. Versions 3.25.23 and below include npm install in a default list of auto-approved commands. Because npm install executes lifecycle scripts, a...

Exploit for CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall...

Malicious versions of Nx were published

Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts. Immediate Actions Required For all users, check if you were...

Embeded Malicious Code

Overview @nx/key is a part of the Nx Powerpack extensions for Nx. This plugin provides the ability to activate and read licenses for Nx Powerpack Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named...

Embeded Malicious Code

Overview @nx/workspace is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named...

Embeded Malicious Code

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named telemetry.js. A...

Embeded Malicious Code

Overview @nx/devkit is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. This package contains a set of utilities for creating Nx plugins. Affected versions of this package are vulnerable to Embeded Malicious Code throug...

Malicious code in used-first-in-postinstall-script-dotslashed (npm)

The package used-first-in-postinstall-script-dotslashed was found to contain malicious code...

MAL-2025-37964 Malicious code in used-first-in-postinstall-script-dotslashed (npm)

The package used-first-in-postinstall-script-dotslashed was found to contain malicious code...

MAL-2025-6829 Malicious code in tensorflowjs (npm)

Package is malicious due to code obfuscation, arbitrary command execution via childprocess.spawn, and suspicious postinstall script. --- -= Per source details. Do not edit below this line.=-...

AI-Generated Malicious npm Package Drains Solana Funds from 1,500+ Before Takedown

Cybersecurity researchers have flagged a malicious npm package that was generated using artificial intelligence AI and concealed a cryptocurrency wallet drainer. The package, @kodane/patch-manager, claims to offer "advanced license validation and registry optimization utilities for high-performan...

Malicious code in udn_extras (npm)

The package is a malware because it contains a postinstall script that executes index.js. The index.js script gathers sensitive information such as hostname, platform, username, IP address, and environment variables and sends it to an external server webhook.site via an HTTPS POST request. This...

MAL-2025-6387 Malicious code in udn_extras (npm)

The package is a malware because it contains a postinstall script that executes index.js. The index.js script gathers sensitive information such as hostname, platform, username, IP address, and environment variables and sends it to an external server webhook.site via an HTTPS POST request. This...

Embedded Malicious Package

Overview @toptal/picasso-forms is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...

Embedded Malicious Package

Overview @toptal/picasso-tailwind is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...