Malicious Package

Overview vue-sfc-require-hook is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2025-44026

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions prior to 6.3 Description The Pi-hole Admin Interface, a web interface for managing the Pi-hole advertisement and internet tracker blocking application, contains a Carriage Return Line Feed CRLF injection flaw...

QueryIPI: Query-Agnostic Indirect Prompt Injection on Coding Agents

Modern coding agents integrated into IDEs combine powerful tools and system-level actions, exposing a high-stakes attack surface. Existing Indirect Prompt Injection IPI studies focus mainly on query-specific behaviors, leading to unstable attacks with lower success rates. We identify a more sever...

Malicious code in @aml-ark/ark-experience-byteplus (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b9a81d78ce8d8f1da9a31e80166834c3098ef03d5ef0e58e1a03d1d93418314 Any computer that has this package installed or running should be considered...

Malicious code in dhnas (npm)

The package dhnas was found to contain malicious code...

Malicious code in jvector-release (npm)

The package jvector-release was found to contain malicious code...

Malicious code in ragstack-ai (npm)

The package ragstack-ai was found to contain malicious code...

Malicious code in frontend-vite (npm)

The package frontend-vite was found to contain malicious code...

Malicious code in dhhdbank92013 (npm)

The package dhhdbank92013 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-48719 Malicious code in ldhpgemrdhs60152 (npm)

The package ldhpgemrdhs60152 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

EUVD-2025-35727

Captive Portal can expose sensitive information...

Malicious code in node-dev-config (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in example-ssr (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48831 Malicious code in dayotest21938 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in circuit-runtime-test (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-53050

...

CVE-2025-53052

...

CVE-2025-53051

CVE-2025-53051 affects Oracle Database Server’s RDBMS Functional Index component, with affected versions 23.4–23.9. The vulnerability enables a high-privilege SYSDBA attacker, with network access via Oracle Net, to read a subset of RDBMS Functional Index data. The CVSS base score is 2.7 (LOW) wit...

EUVD-2025-35164

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit the...

Malicious Package

Overview funny-pad is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...