EUVD-2017-16331

Malware in sbrugna...

EUVD-2017-16329

Malware in sbrugna...

EUVD-2017-17345

Malware in sbrugna...

EUVD-2020-0055

Malware in sbrugna...

EUVD-2013-3871

Malware in sbrugna...

EUVD-2021-22946

Malware in sbrugna...

EUVD-2021-17513

Malware in sbrugna...

EUVD-2024-0048

Malicious code in bioql PyPI...

EUVD-2025-30449

Malicious code in bioql PyPI...

EUVD-2025-2134

Malicious code in bioql PyPI...

EUVD-2022-15597

Malicious code in bioql PyPI...

EUVD-2023-50219

Malicious code in bioql PyPI...

EUVD-2023-50218

Malicious code in bioql PyPI...

EUVD-2025-16293

Malicious code in bioql PyPI...

CVE-2025-59526

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintextemail method is used and given...

When Dependencies Turn Dangerous: Responding to the NPM Supply Chain Attack

On September 8, 2025, attackers compromised a set of 18 widely used npm packages —including chalk, debug, ansi-styles, and strip-ansi—collectively downloaded over 2.6 billion times per week. Through a targeted phishing campaign against a maintainer, the attackers published malicious versions...

Malicious code in strip-ansi (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3736bb5cc515b07f47ad6b5bb06c367271994c4b6606f1ddeb91a056788c34c2 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-46980 Malicious code in strip-ansi (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3736bb5cc515b07f47ad6b5bb06c367271994c4b6606f1ddeb91a056788c34c2 Any computer that has this package installed or running should be considered fully compromised. All...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code activates a hook whenever a Web3 wallet is present...

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

...