MAL-2025-25592 Malicious code in loop-wolf-vortex-yonder (npm)

The package loop-wolf-vortex-yonder was found to contain malicious code...

MAL-2025-19446 Malicious code in electron-builder-wolf-subscription-xml (npm)

The package electron-builder-wolf-subscription-xml was found to contain malicious code...

MAL-2025-39403 Malicious code in wolf-arcturus-parcel-juno (npm)

The package wolf-arcturus-parcel-juno was found to contain malicious code...

MAL-2025-14990 Malicious code in async-paleobotany-wolf-eslint-config (npm)

The package async-paleobotany-wolf-eslint-config was found to contain malicious code...

Malicious code in wolf-thermochronology-europa-chakra-ui (npm)

The package wolf-thermochronology-europa-chakra-ui was found to contain malicious code...

Malicious code in australis-commitlint-loopback-wolf (npm)

The package australis-commitlint-loopback-wolf was found to contain malicious code...

Malicious code in wolf-cache-inflation-selenium (npm)

The package wolf-cache-inflation-selenium was found to contain malicious code...

MAL-2025-16774 Malicious code in chalk-winston-wolf-semantic-release (npm)

The package chalk-winston-wolf-semantic-release was found to contain malicious code...

Malicious code in farout-fetch-eslint-config-wolf (npm)

The package farout-fetch-eslint-config-wolf was found to contain malicious code...

Malicious code in electron-builder-wolf-subscription-xml (npm)

The package electron-builder-wolf-subscription-xml was found to contain malicious code...

MAL-2025-27828 Malicious code in npm-chalk-wolf-aurora (npm)

The package npm-chalk-wolf-aurora was found to contain malicious code...

MAL-2025-29533 Malicious code in postcss-blaze-hermes-wolf (npm)

The package postcss-blaze-hermes-wolf was found to contain malicious code...

MAL-2025-27717 Malicious code in non-blocking-wolf-umbra-gacrux (npm)

The package non-blocking-wolf-umbra-gacrux was found to contain malicious code...

Malicious code in non-blocking-wolf-umbra-gacrux (npm)

The package non-blocking-wolf-umbra-gacrux was found to contain malicious code...

Malicious code in glaciology-wolf-parsec-server (npm)

The package glaciology-wolf-parsec-server was found to contain malicious code...

MAL-2025-21544 Malicious code in glaciology-wolf-parsec-server (npm)

The package glaciology-wolf-parsec-server was found to contain malicious code...

MAL-2025-39405 Malicious code in wolf-thermochronology-europa-chakra-ui (npm)

The package wolf-thermochronology-europa-chakra-ui was found to contain malicious code...

No QUIC certificate pinning with wolfSSL

...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through pinning of the server certificate public key for HTTPS transfers. An attacker can impersonate a legitimate server and intercept or manipulate communications by presenting a fraudulent certificate...

DEBIAN-CVE-2025-5025

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC...