Malicious Package

Overview moodle-corefilepicker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwind-react-icon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview openai-fm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview chime-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-0993

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources...

CVE-2025-1278

An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information...

CVE-2024-3303

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection...

MAL-2024-11133 Malicious code in crypto-jsonwebtoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25abe83f5832dadd36db735f0f385e70d4f55987a913448a70c7df4ea1c28762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11075 Malicious code in release-notice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9188a12e63756142475c425c675afc5c47d67d58761c182bb785745a2b7298fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview 123bla is a malicious package. This package contains malicious code and was removed from the package manager. Remediation Avoid using all malicious instances of the 123bla package...

MAL-2024-9364 Malicious code in elk1yf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 471b28d9ba2a82d14b4dc81f5a18c4cbce414ac60e2f843c8023da9b01b639bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9258 Malicious code in wassup-shiva (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0899fc457c77b483e51bf66f4a0c586cfa9ad8c89be4ae2541efd3bc435a09d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8873 Malicious code in sketch-crowdin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 760414998be33a4144fb0eee0455cc462dea5f95e07189b1ff637271a0014974 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8694 Malicious code in @diotoborg/voluptate-exercitationem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4274d4147585223d28d30dd0cf0344e18a7ad871ebe9bb592edaae45ffeea044 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8700 Malicious code in @diotoborg/voluptatibus-impedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f899aca45c84128990918b2b6dd9dd004f1c68c1247ccbe88cd9e4d2bd4641ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8091 Malicious code in tpro_pc_yyb_open_platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d15d2ff8ee637d306770e71be2fd88a7a4120d1560980b598bc86166f56dd479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7880 Malicious code in taiwinders (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dab44b2fa45e4dc1c7966fb53989bb8c53c203f15da117a99bcab2ce4d1125c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7751 Malicious code in img-aws-s3-object-multipart-copy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fdc2d1b94cc9bdb2bee2f06bd13d0be50208d8185a82a733718d2edcdcee70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7370 Malicious code in @zitterorg/repellendus-impedit-repellendus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 531d75d11257ca637d934389a2c2e3dc5441fa2bc6daa92d3e0ea33ed66edf3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7246 Malicious code in @zitterorg/itaque-quae-dolore (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c7ab1e9fb28c3ea59e90ffacfd615f323775e17e135abb363d39b988b957125 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...