Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

@dadigua/hyper-chat (>=1.2.3, <=1.2.16), @rse/closingcredits (>=1.0.1, <=1.0.5) +3 more potentially affected by CVE-2025-13437 via zx (>=8.0.0, <=8.1.0)

zx NPM version =8.0.0, =1.2.3, =1.0.1, =2.15.6, =2.15.6, =3.0.5, =3.0.10 Source cves: CVE-2025-13437 Source advisory: SNYK:JS-ZX-14089787...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +35 more potentially affected by CVE-2025-64765 +1 more via astro (>=5.0.0-beta.5, <=5.15.6)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64765, CVE-2025-66202 Source advisory: OSV:GHSA-GGXQ-HP9W-J794...

Mageia: Security Advisory (MGASA-2025-0292)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21360 more potentially affected by CVE-2025-64718 via js-yaml (>=3.0.0, <=3.14.1)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2025-64718 Source advisory: OSV:GHSA-MH29-5H37-FV8M...

EUVD-2025-179233

Malicious code in duplex-request-astrometry-titan npm...

EUVD-2025-132877

Malicious code in @akunsansan0/jorelat14 npm...

@akunsansan0/cewe (1.0.0), @akunsansan0/teaguntur99 (>=1.1.4, <=1.1.5) +10 more potentially affected by unknown CVE via teaguntur99 (1.1.4)

teaguntur99 NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on teaguntur99 and may be impacted: - @akunsansan0/cewe 1.0.0 - @akunsansan0/teaguntur99 =1.1.4, =1.1.5 - @satria9897/air 1.0.0 - air1 1.1.0 - air10 1.1.0 - air2 1.1.0 - air3...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala60 (1.0.0)

nokire-nakala60 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala60 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163015...

siddheshtea (1.1.6) potentially affected by unknown CVE via manda-3 (1.0.0)

manda-3 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on manda-3 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-159626...

Huawei EulerOS: Security Advisory for cmake (EulerOS-SA-2025-2318)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2025-2317)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EUVD-2025-98707

Malicious code in galih-ongol-ongol35-riris npm...

EUVD-2025-99243

Malicious code in erick-getas3-riris npm...

MAL-2025-121581 Malicious code in live_flea_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f105af940accd98b0855ce2c210c4ae79d2010cb50b698125551aee2f5e5c1dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...