386 matches found
MAL-2025-66151 Malicious code in wibowo-kue2-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a66f38c19b8ea99e3d3a1f175c07447183c11a410cae3edc04377b289e513ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
[SECURITY] Fedora 43 Update: skopeo-1.20.0-5.fc43
Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...
Toward Understanding Security Issues in the Model Context Protocol Ecosystem
The Model Context Protocol MCP is an emerging open standard that enables AI-powered applications to interact with external tools through structured metadata. A rapidly growing ecosystem has formed around MCP, including a wide range of MCP hosts i.e., Cursor, Windsurf, Claude Desktop, and Cline, M...
Malicious Package
Overview epxreso is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious Package
Overview tailwind-beauty-icon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
[SECURITY] Fedora 41 Update: skopeo-1.20.0-3.fc41
Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...
EUVD-2019-13461
Malware in sbrugna...
EUVD-2019-4405
Malware in sbrugna...
Malicious Package
Overview pc-analytics-promotion-creation-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...
Why Software Signing (Still) Matters: Trust Boundaries in the Software Supply Chain
Software signing provides a formal mechanism for provenance by ensuring artifact integrity and verifying producer identity. It also imposes tooling and operational costs to implement in practice. In an era of centralized registries such as PyPI, npm, Maven Central, and Hugging Face, it is...
EUVD-2025-29227
Malicious code in bioql PyPI...
EUVD-2022-43161
Malicious code in bioql PyPI...
EUVD-2023-1882
Malicious code in bioql PyPI...
EUVD-2025-29229
Malicious code in bioql PyPI...
EUVD-2023-1763
Malicious code in bioql PyPI...
[SECURITY] Fedora 42 Update: skopeo-1.20.0-3.fc42
Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...
GHSA-FRH7-2F84-V9MW [email protected] contains malware after npm account takeover
Impact On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's ow...
GHSA-6JP5-HH4C-8C5H [email protected] contains malware after npm account takeover
Impact On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own...
[email protected] contains malware after npm account takeover
Impact On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's...
GHSA-286P-VC9P-P5QV [email protected] contains malware after npm account takeover
Impact On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's...