MAL-2025-4038 Malicious code in wal-eth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31f1190c63c1f6bf955ab1d1638b199634786321614c27c73a56718a80770295 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4018 Malicious code in say-hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e0eac5e92f8a98fe25febcb3c44e78e8b816e619470dbb45f8276cb67cdac7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4024 Malicious code in social-network-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89279e5bb7b18cd7f18b0018f976d1e055fbeb331245019a6c3e75796c3bf1e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SAP NetWeaver Visual Composer Metadata Uploader Deserialization Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader is a component in SAP NetWeaver for uploading metadata. A deserialization vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader that originates from deserializing malicious content, which can be exploited by an attacker to cause a...

MAL-2025-3901 Malicious code in let-me-know (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f3ad0e2a6330c91c21a459de54a84f8ce2fdaaee7864cf564b92f63b4f25b21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-42999 Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

MAL-2025-3679 Malicious code in bitpay-push-notification-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff585151e0d20f0a3114337d0053b2fa14d0b74c758b8d3a60f9645028bba9f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3612 Malicious code in aspose (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc6b6ee0294def0dac75dde8c136ed50e9a8e33324beaea4ab4a595a2e8f5171 Any computer that has this package installed or running should be considered...

MAL-2025-3585 Malicious code in smart-wallet-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 438e7146621a62ca96ad70b6bcd6f1c28b3a10ad7649aae209b0d05def80752f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-43854

DIFY (LangGenius Open Source) prior to version 1.3.0 is affected by a clickjacking vulnerability in the default web setup. The issue allows an attacker to trick users into clicking on elements, potentially triggering unauthorized actions and compromising security/privacy. The vulnerability is fix...

MAL-2025-3696 Malicious code in poc-npm-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c566d52416b7be560224ad7d3f57924013882a6ee87a79754da4ba6f174c2106 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in list.fuzzysearch.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e7008d1b039aad972325f177113a9d0a1843f63cd1c83d67809a42cca84abfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-17433 · Unknown · Soffid Console

Name of the Vulnerable Software and Affected Versions: Soffid Console versions 3.5.38 through 3.5.38 Soffid Console versions 3.6.31 through 3.6.31 Description: The issue is related to the mishandling of authorization to use the pam service in Soffid Console. Additionally, necessary checks were no...

MAL-2025-3266 Malicious code in zkevm-commonjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f97b3c164e028fa05d0832ddbf8afc66fa090caec4d50eac611b2132c8b24925 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-3114

Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandb...

MAL-2025-3201 Malicious code in some-error-logging-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ec550029e2d4afb8e030a4f5d0f35eed74507e8c10420197915d518200ef38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3160 Malicious code in okmanalright (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2727510b2d20ad0199648c80f577b241990e17e37d1fa598e2cee9a34d5716b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3114 Malicious code in prettier-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e45dae9f24ebe77c9b7a50a5c45b3a141874389968d29e773f3f2aa8633a0a9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3049 Malicious code in @hongfangze/office (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25f57ae31d0133a71e4274c381dcefb8e00468c17cd0a7df89a9a4bbae15baa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @takamol/ets-react-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f82dcc5edf4748a4186895186924ee28e0f55fe782fe6b7e4d4f6ffe895195d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...