Malicious code in create-shopify-web-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 060088163bdd31721ea28bf31315bd2e50c4dd13215f62116756f66a3b69af83 Any computer that has this package install...

Malicious code in forcechatter (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e548ac2ba4e7e0cf0cceee4f34c9ae9aed9e72846aad09c730e9c4460d81354 Any computer that has this package install...

Malicious code in swisscom-scaleio (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c56983709f53a43b82244bcb874d8ee94f893ad1f3c90d2bb0c4e875d5bb97b Any computer that has this package install...

MAL-2025-10 Malicious code in forcechatter (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e548ac2ba4e7e0cf0cceee4f34c9ae9aed9e72846aad09c730e9c4460d81354 Any computer that has this package install...

Malicious code in treedome (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 684ae3e40b1c465aa22e0c0351dbd7dee0a7ebd2216a70b401167c95ae3b87d2 Any computer that has this package install...

MAL-2025-7 Malicious code in treedome (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 684ae3e40b1c465aa22e0c0351dbd7dee0a7ebd2216a70b401167c95ae3b87d2 Any computer that has this package install...

Malicious code in cbpay-js (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ae77ff8389d6c4b04ac665b524c5b721d9792b77d2b2a7b8e3f4b6bdd9c58c0 Any computer that has this package install...

Malicious code in safe-apps-react-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4844f797621f2cd62b20851643278b7d27cfc2ca46fdd1485383cd7818d5c0a8 Any computer that has this package install...

Malicious code in safe-react-components (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb053fb51230ded6b594cc92293d5377c31b4b9fd8d47e14e46d824d7e672910 Any computer that has this package install...

Malicious code in payouts-banking-info (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d795b5a9cc9952f39cd020e529f31f96f837544ae12bdb31f13d66970d9824d4 Any computer that has this package install...

PT-2025-1323 · Unknown · Net::Easytcp

Name of the Vulnerable Software and Affected Versions: Net::EasyTCP versions prior to 0.15 Description: The issue concerns the use of Perl's built-in rand function, which is not a strong random number generator, for generating cryptographic keys. This weakness can potentially lead to predictable...

PT-2025-1534 · Wp Travel · Wp Travel

Name of the Vulnerable Software and Affected Versions: WP Travel versions prior to 7.8.0 Description: The issue is related to missing authorization in WP Travel, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions prior to 7.8.0, update to...

PT-2025-2499 · Unknown · Swift Performance Lite

Name of the Vulnerable Software and Affected Versions: Swift Performance Lite versions prior to 2.3.6.20 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the us...

PT-2025-50334

Name of the Vulnerable Software and Affected Versions sd command versions prior to 1.0.0 Description An issue allows attackers to escalate privileges to root via a crafted command. Recommendations Update to a version newer than 1.0.0...

PT-2025-32595

Name of the Vulnerable Software and Affected Versions: slab versions prior to 0.4.11 Description: slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get disjoint mut function incorrectly checked if indices were within the slab's capacity instead of its length,...

PT-2025-36262

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's netfilter module, specifically within the nf reject functionality. The issue involves a potential information leak of the destination reference count...

PT-2025-38056

Name of the Vulnerable Software and Affected Versions: LDAP Account Manager versions prior to 9.3 Description: LDAP Account Manager LAM is a web frontend for managing entries stored in an LDAP directory. The application allows stored cross-site scripting in the Profile section via the profile nam...

Malicious code in valid-package (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccad71901dd807f11aedc2ca2f34c92319f90ccbf3fea758a765c78eb2ff6bdb Any computer that has this package install...

Malicious code in babel-preset-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c7766597c4e69a6b6b08fb89e552f8cff845299eb1b612ef107e5f3fcb96156 Any computer that has this package install...

MAL-2024-12176 Malicious code in valid-package (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccad71901dd807f11aedc2ca2f34c92319f90ccbf3fea758a765c78eb2ff6bdb Any computer that has this package install...