AI Code Hallucinations Increase the Risk of ‘Package Confusion’ Attacks

A new study found that code generated by AI is more likely to contain made-up information that can be used to trick software into interacting with malicious code...

MAL-2025-3660 Malicious code in pie-docs (npm)

This package steals IP address and sent it to C&C server in preinstall hook...

MAL-2025-3557 Malicious code in redmins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbc5bc9b00f12ad85587941ac33154352652d85f6c05ec40ecdeb697b7dc20a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DLA-4126-2 jinja2 - regression update

Bulletin has no description...

DLA-4144-1 qemu - security update

Bulletin has no description...

CGA-JRWQ-7RGM-H5M4

Bulletin has no description...

CGA-47XV-JQ34-598V

Bulletin has no description...

GHSA-R9GV-QFFM-XW6F Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Summary Vulnerable Version: Yeswiki alert1 Details Reflected Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in...

BELL-CVE-2025-2866

Bulletin has no description...

DLA-4142-1 libraw - security update

Bulletin has no description...

PT-2025-18184 · Slims · Slims

Name of the Vulnerable Software and Affected Versions: Slims Senayan Library Management Systems version 9.6.1 Description: The issue is related to SQL Injection in the admin/modules/master file/coll type.php file. This allows for potential exploitation. No information is provided about the...

@account-kit/smart-contracts Allowlist Module Bypass Vulnerability

Allowlist module contains a bypass vulnerability...

MAL-2025-5141 Malicious code in wallettronpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6232d6f8e03368abc5a38f906502206757571193ce7daf078c26f2e0cd159882 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-4247 Malicious code in tronlix (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 007bba18e8334f8678c8256d3d77e35146758c5b14ae9861c883b6ef7fbee6ff Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

CGA-XPG4-X32H-C6H7

Bulletin has no description...

CGA-JWCH-FP6C-JXGV

Bulletin has no description...

CGA-JR86-6PHC-M7WG

Bulletin has no description...

CGA-XV22-G48C-PX9C

Bulletin has no description...

GHSA-37PQ-893F-G7Q5 Apereo CAS code injection vulnerability

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

MAL-2025-4205 Malicious code in alchemyrpcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c3de5cb8ee8e308aa3b7dbfcb71e5c3d5becf9c41b1bdfee75a00b4a29c3663a Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...