CVE-2025-59160 matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated...

CVE-2025-59160 matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated...

CVE-2025-59160

The CVE-2025-59160 entry concerns the Matrix JavaScript SDK (matrix-js-sdk) prior to version 38.2.0, where MatrixClient::getJoinedRooms performs insufficient validation of room predecessor links. This can allow a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-s...

CVE-2025-59160

Removed by vendor...

MAL-2025-47264 Malicious code in @pumpfun-sdk/bn-converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bcd5e8715873a001eadde3f34011c22ba27a599e02a712fde9f44036b62fb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @pumpfun-sdk/bn-converter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @pumpfun-sdk/bn-converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bcd5e8715873a001eadde3f34011c22ba27a599e02a712fde9f44036b62fb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47265 Malicious code in @pumpfun-sdk/metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe74efc7770fd428add3639b89ec07606c3be7a22d6c185ef00ad4beb39b9c15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MetaMask SDK indirectly exposed via malicious [email protected] dependency

Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: - Installed MetaMask SDK into a project with a lockfile for the first time -...

@aarc-dev/auth-widget (>=0.0.1, <=0.0.20), @aarc-dev/wallet-auth (>=0.0.11, <=0.0.20) +9 more potentially affected by unknown CVE via @metamask/sdk-react (>=0.16.0, <=0.30.2)

@metamask/sdk-react NPM version =0.16.0, =0.0.1, =0.0.11, =0.0.12, =0.16.0, =0.3.0, =0.5.6, =0.9.0, =0.0.7, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-QJ3P-XC97-XW74...

@0xshogun/sdk-react (1.1.40), @0xsquid/deposit-widget (>=0.0.2-beta.0, <=0.2.0) +242 more potentially affected by unknown CVE via @metamask/sdk (>=0.16.0, <=0.33.0)

@metamask/sdk NPM version =0.16.0, =0.0.2-beta.0, =2.1.11-beta.0, =3.0.0-beta.16, =0.0.1, =0.0.11, =0.2.1, =4.0.0-alpha.0, =3.16.0, =1.0.0, =1.0.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-QJ3P-XC97-XW74...

@0xshogun/sdk-react (1.1.40), @0xsquid/deposit-widget (>=0.0.2-beta.0, <=0.2.0) +243 more potentially affected by unknown CVE via @metamask/sdk-communication-layer (>=0.16.0, <=0.33.0)

@metamask/sdk-communication-layer NPM version =0.16.0, =0.0.2-beta.0, =2.1.11-beta.0, =3.0.0-beta.16, =0.0.1, =0.0.11, =0.2.1, =4.0.0-alpha.0, =3.16.0, =1.0.0, =1.0.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-QJ3P-XC97-XW74...

GHSA-QJ3P-XC97-XW74 MetaMask SDK indirectly exposed via malicious [email protected] dependency

Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: - Installed MetaMask SDK into a project with a lockfile for the first time -...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager ( CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754)

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Malicious code in basic-pump-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc10b9f2bba8789f982dedfa26ff72ba0c4149b11d522b1d60523fac65c58419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47174 Malicious code in basic-pump-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc10b9f2bba8789f982dedfa26ff72ba0c4149b11d522b1d60523fac65c58419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview basic-pump-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @huobi-lib/vulcan-js-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @huobi-lib/vulcan-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19abe7ab9afcd189bbbd5061add8629d1f576b8dae3944cc7974b7581ffbd570 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47145 Malicious code in @huobi-lib/vulcan-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19abe7ab9afcd189bbbd5061add8629d1f576b8dae3944cc7974b7581ffbd570 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...