MAL-2025-5792 Malicious code in rita-remoteista (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae4e995a07a4d4dde2738ea6213c272990a85dd9d4f6f3ff92eaff2cefd021b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5781 Malicious code in hubspot-cms-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb6184defa0162c7c46179a4c0e85e5df794bc2fadb23f9649184487324684b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5783 Malicious code in intel-gdb-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9e59a0db399c7f1fa0d97b250969ebd703c83cb6c7e03b6ab8a3ec34f67746d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5769 Malicious code in dependabot-ruleset-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf6203024b7b15e14f8667f837a351ecd9b34c2298117e781b04de05af28cdc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5796 Malicious code in sqltools-kusto-driver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b4f7793f8ffb915758717bd05607ceb0b5f0d1525a564240e518e4191985f95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5746 Malicious code in @nomicsfoundation/sdk-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dd2aa93af5e60cc32d01700108f493d86a9f886cc6a62fb60b06ce088a605e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-3920

A vulnerability was identified in SUR-FBD CMMS where hard-coded credentials were found within a compiled DLL file. These credentials correspond to a built-in administrative account of the software. An attacker with local access to the system or the application's installation directory could extra...

MAL-2025-5741 Malicious code in zigbee2mqtt.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e185d275e7942dc0c0abd3cbf5b1cba185b969d6d54054fb427fa26369283774 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5733 Malicious code in tickets-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9377af3ff9889209078306e2ccd858a9c161cb6aaa6f315d355fd1d797abe26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5671 Malicious code in berrynet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f54dd403bf9ea745a960f5acd6f5119e6a874444ab0bfae5660880850cebea4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5694 Malicious code in gdpr-tracker-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8a07210a79f85c1ecd79351c780ee3e0c92be87207480cf11d712ef9aaf0d74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-3920

CVE-2025-3920 affects SUR-FBD CMMS: hard-coded credentials exist inside a compiled DLL that maps to a built-in admin account. An attacker with local access could extract these credentials and potentially fully compromise the application's administrative functions. The issue has been fixed in vers...

GHSA-M84C-4C34-28GF LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component

Incomplete Documentation of Program Execution exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer...

MAL-2025-5721 Malicious code in protobufjs-websocket-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a5372e68ba0b48947bc24234bd3009eaf3350edf61ca65bd42229c19a046fe8 Any computer that has this package installed or running should be considered...

MAL-2025-5678 Malicious code in confluence-drag-and-drop (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54563a65c5fe90e7a08c946b6834cd15582defd6ad21f41d09867195dc699b36 Any computer that has this package installed or running should be considered...

MAL-2025-5615 Malicious code in auth0-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bb8364e4a661d732190dea931ee1bd3aedea3c1005b1daa41507601bb281443 Any computer that has this package installed or running should be considered...

MAL-2025-5692 Malicious code in frontend-redux (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acdef714be7b489390b18befe70797dd12ccf6a4ce971ef0c840b5f3008dde9b Any computer that has this package installed or running should be considered...

MAL-2025-5597 Malicious code in @figshare/old-viewers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b582af08f54b24b027eb8ffb5e56e63e4efff4c947ef2abb5fc552a7476539d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5539 Malicious code in @pwly/powerley-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cea10042520397029e8346d0d6b95495a3c2184102f2d8caedfff5b7e3d47b1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5567 Malicious code in myrepotesting-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 699a8d5ecf04b9f79eb58425d416193bbb768ed786ea839d85fd4f46e827d017 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...