CVE-2025-59140

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59140

The CVE-2025-59140 issue concerns the backslash npm package. A phishing-attack comp compromised the package owner’s account on 8 September 2025 and published v0.2.1, which added a malware payload targeting cryptocurrency transactions in browser contexts (e.g., MetaMask), while local/server/CLI en...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through multiple vector store integrations. An attacker can read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the library in a web application...