messageformat has a prototype pollution vulnerability

The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special character...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the removeAttributeNS function. An attacker can manipulate the prototype chain of JavaScript objects, potentially causing a denial-of-service attack by supplying malicious input that targets the proto property...

CVE-2025-57352

A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the proto property, an attacker can manipulate the prototype chain of JavaScript objects,...

Prototype Pollution

devalue is vulnerable to prototype pollution. The vulnerability is due to devalue.parse not validating that an index is numeric, which allows an attacker to pass a crafted string with a proto property to assign prototypes to objects and properties...

MAL-2025-46984 Malicious code in proto-tinker-wc (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7c28102f10f0e7abdda4eaae50e9db8edf27c3b15fe2ba6841ceb95fa907adc Any computer that has this package installed or running should be considered fully compromised. All...

Embedded Malicious Code

Overview proto-tinker-wc is a prototype app written in Stencil and Tailwind, deployed via NPM and Vercel. Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypt...

Malicious code in secret-scanning-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1465959a0117b88d5bd9a996a386b97399277821a3199d62026605750c8194b7 The OpenSSF Package Analysis project identified 'secret-scanning-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: -...

MAL-2025-46942 Malicious code in secret-scanning-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1465959a0117b88d5bd9a996a386b97399277821a3199d62026605750c8194b7 The OpenSSF Package Analysis project identified 'secret-scanning-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: -...

Malicious code in proto-education-web (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe0791b8a3d9af1c4b04c567db2fc37ae9cbacd29a4ace0c5e07b75720f6c718 The OpenSSF Package Analysis project identified 'proto-education-web' @ 0.0.7.ref8a4ad331 rubygems as malicious. It is considered malicious...

MAL-2025-46940 Malicious code in proto-education-web (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe0791b8a3d9af1c4b04c567db2fc37ae9cbacd29a4ace0c5e07b75720f6c718 The OpenSSF Package Analysis project identified 'proto-education-web' @ 0.0.7.ref8a4ad331 rubygems as malicious. It is considered malicious...

Malicious code in proto-dependabot-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 020a9f64907bc95144ea451f388a29465ae090673bbbcc3adcabe76b5862bf73 The OpenSSF Package Analysis project identified 'proto-dependabot-api' @ 1.1.3.r8cdd21224 rubygems as malicious. It is considered malicious...

MAL-2025-46939 Malicious code in proto-dependabot-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 020a9f64907bc95144ea451f388a29465ae090673bbbcc3adcabe76b5862bf73 The OpenSSF Package Analysis project identified 'proto-dependabot-api' @ 1.1.3.r8cdd21224 rubygems as malicious. It is considered malicious...

MAL-2025-46941 Malicious code in proto-trust-metadata-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b87774d0bcfbcd33d81c38f3c6d26c986559b07bc1e15717164022afe4de346c The OpenSSF Package Analysis project identified 'proto-trust-metadata-api' @ 99.99.99 rubygems as malicious. It is considered malicious because:...

Malicious code in proto-trust-metadata-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b87774d0bcfbcd33d81c38f3c6d26c986559b07bc1e15717164022afe4de346c The OpenSSF Package Analysis project identified 'proto-trust-metadata-api' @ 99.99.99 rubygems as malicious. It is considered malicious because:...

Malicious code in proto-registry-metadata-migrator-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f6ca959b9d60c57a5ad820c14ad427eb18e0eafb21458822d623fad47360fd7 The OpenSSF Package Analysis project identified 'proto-registry-metadata-migrator-api' @ 1.10.6.83.g459bcec7 rubygems as malicious. It is...

MAL-2025-46962 Malicious code in proto-registry-metadata-migrator-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f6ca959b9d60c57a5ad820c14ad427eb18e0eafb21458822d623fad47360fd7 The OpenSSF Package Analysis project identified 'proto-registry-metadata-migrator-api' @ 1.10.6.83.g459bcec7 rubygems as malicious. It is...

Malicious code in spokes-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5143229da29f3bb1eee97d5c099069507b7d24788d46679d7142c452c50d8b17 The OpenSSF Package Analysis project identified 'spokes-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The packa...

MAL-2025-46944 Malicious code in spokes-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5143229da29f3bb1eee97d5c099069507b7d24788d46679d7142c452c50d8b17 The OpenSSF Package Analysis project identified 'spokes-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The packa...

Malicious code in proto-registry-metadata-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1f7ab6f94cef6b0a1e53365370e91527c5c546ab409345d8a77877f5927f677 The OpenSSF Package Analysis project identified 'proto-registry-metadata-api' @ 1.11.3.87.g981ef7d3d rubygems as malicious. It is considered...

MAL-2025-46920 Malicious code in proto-registry-metadata-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1f7ab6f94cef6b0a1e53365370e91527c5c546ab409345d8a77877f5927f677 The OpenSSF Package Analysis project identified 'proto-registry-metadata-api' @ 1.11.3.87.g981ef7d3d rubygems as malicious. It is considered...