Malware in @js-to-lua/handler-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview jsexports-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in jsexports-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faa85960d0da372c3591bd8e6336208f04090cc24ca88b734d8e84d5f389c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in jsexports-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47019 Malicious code in jsexports-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faa85960d0da372c3591bd8e6336208f04090cc24ca88b734d8e84d5f389c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2022-24279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes...

Linux Distros Unpatched Vulnerability : CVE-2025-6224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netwo...

CodeceptJS's incomprehensive sanitation can lead to Command Injection

CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary...

Malicious Package

Overview classbreeze-utils is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

Malicious Package

Overview twcompose-utils is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

MAL-2025-46148 Malicious code in string-modifier-utils (npm)

The package string-modifier-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-58361

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips "javascript:"...

CVE-2025-26439

In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system component due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-58361: Improper Input Validation

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips javascript: a...

Use of Incorrectly-Resolved Name or Reference

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending specially craft...

Use of Incorrectly-Resolved Name or Reference

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending...

MAL-2025-47755 Malicious code in data-processing-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f5c7542831f6f9fe72a65e436b1f85c10261aac12ceae6f1bcc490afad6d1aaa Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious...

CVE-2025-9796 thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting

A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made...

Malicious code in react-native-wm-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790e08de4e57c51f573e613b7cdd780343c4f14a00aadaff30e05fca9cb69f8b Any computer that has this package installed or running should be considered...

MAL-2025-45766 Malicious code in react-native-wm-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790e08de4e57c51f573e613b7cdd780343c4f14a00aadaff30e05fca9cb69f8b Any computer that has this package installed or running should be considered...