MAL-2025-8 Malicious code in 4m-clean-shopify-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff1dc78c54862db7c3a030ea6817abc308fbdfe0d28be84a7203e062ab025963 Any computer that has this package install...

Malicious code in lambda-sns-dynatrace-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6846e2cf86562a1515400ba129d4fef5beb818c3002079e8bdd09c9e86f00fc5 Any computer that has this package install...

Malicious code in spectro-cloud-docs (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5f48697cbdd8e8f64a4634d5d8ea37633a9f97394cf53ceac7d2e6a05fb41e Any computer that has this package install...

Malicious code in malicious-pre-install-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1741456bb70a37b2485b448c939f1c6bac3387f988e30a89c5ae1516b1610105 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

olcne security update

coredns 1.7.0-1 - Added Oracle specific build files cri-o 1.18.4-2 - Fix for CVE-2021-27918 1.18.4-1 - Added Oracle Specifile Files for cri-o cri-tools 1.18.0-2 - Address CVE-2021-27918 etcd 3.4.3-1.0.5 - Address CVE-2021-27918 flannel 0.12.0-2 - Address CVE-2021-27918 yq 3.4.0-2 - Address...

Malicious Package

xpc.js is a malicious package. It contains malicious codes in its pre-install script that executes two malicious exe files containing Trojan malware...

CVE-2020-12880

An issue was discovered in Pulse Policy Secure PPS and Pulse Connect Secure PCS Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and...

CVE-2020-12880

An issue was discovered in Pulse Policy Secure PPS and Pulse Connect Secure PCS Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and...

Hardcoded credentials

An issue was discovered in Pulse Policy Secure PPS and Pulse Connect Secure PCS Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and...

CVE-2020-12880

CVE-2020-12880 affects Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance prior to 9.1R8. By manipulating a kernel boot parameter, an insider can drop into a root shell in a pre-install phase where the appliance source code is accessible. Root access risk is limited to the...

CVE-2020-12880: Undefined Security Weakness

An issue was discovered in Pulse Policy Secure PPS and Pulse Connect Secure PCS Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and...

Malicious Package

ali-contributor is a malicious package. The malicious package runs a pre-install script, load.js, that would upload system information to a remote server, and subsequently downloads and executes a file...

Malicious Package

froever is a malicious package. It contains malicious codes in its pre-install script that attempt to download a file from a remote server, executes it and opens a backdoor...

Malicious Package

hulp is a malicious package. It contains malicious codes in its pre-install script that attempt to call home to a Command and Control server to execute arbitrary commands...

Malicious Package

jqeury is a malicious package. It contains malicious codes in its pre-install script that attempt to download a file from a remote server, executes it and opens a backdoor...

Malicious Package

logsymbles is a malicious package. It contains malicious codes in its pre-install script that attempt to download a file from a remote server, executes it and opens a backdoor...

Malicious Package

require-ports is a malicious package. It contains malicious codes in its pre-install script that attempt to download a file from a remote server, executes it and opens a backdoor...

Malicious Package

yeoman-genrator is a malicious package. It contains malicious codes in its pre-install script that attempt to download a file from a remote server, executes it and opens a backdoor...

EU Fines Google Record $5 Billion in Android Antitrust Case

Google has been hit by a record-breaking $5 billion antitrust fine by the European Union regulators for abusing the dominance of its Android mobile operating system and thwarting competitors. That's the largest ever antitrust penalty. Though Android is an open-source and free operating system,...

CVE-2015-0296

The pre-install script in texlive 3.1.20140525r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory...