CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
A kind of CWE-912 Hidden Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- prebid prebid-universal-creativePrebid Universal Creative on npm briefly compromised9.3 Critical
- prebid prebid.jsPrebid.js NPM package briefly compromised8.6 High
- duckdb duckdb-nodeDuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware8.6 High
- qix- colorcolor@5.0.1 contains malware after npm account takeover8.8 High
- qix- color-convertcolor-convert@3.1.1 contains malware after npm account takeover8.8 High
- qix- color-stringcolor-string@2.1.1 contains malware after npm account takeover8.8 High
- qix- node-backslashbackslash@0.2.1 contains malware after npm account takeover8.8 High
- qix- node-is-arrayishis-arrayish@0.3.3 contains malware after npm account takeover8.8 High
- qix- node-simple-swizzlesimple-swizzle@0.2.3 contains malware after npm account takeover8.8 High
- colorjs color-namecolor-name@2.0.1 contains malware after npm account takeover8.8 High
- qix- node-error-exerror-ex@1.3.3 contains malware after npm account takeover8.8 High
- debug-js debugdebug@4.4.2 contains malware after npm account takeover8.8 High
- red hat multicluster global hub, openshift serverless, advanced cluster management for kubernetes 2 +1 more +3 moreNx: nx/devkit: malicious versions of nx and plugins published to npm9.6 Critical
num2wordsPyPInum2words subjected to phishing attack, two versions published containing malware9.3 Critical- amazon q developer vs code extensionInert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension5.1 Medium
- prettier eslint-config-prettier, eslint-plugin-prettier, un-ts napi-postinstall +4 more +6 moreeslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code7.5 High
- xrplf xrpl.jsCompromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.29.3 Critical
@cat-wc/utilitiesnpmWithdrawn Advisory: Malware in @cat-wc/utilitiesNo score@weave-mui/dividernpmWithdrawn Advisory: Malware in @weave-mui/dividerNo score- reviewdog action-ast-grep, action-composite-template, action-setup +5 more +7 moreMultiple Reviewdog actions were compromised during a specific time period8.6 High
- tj-actions changed-files, changed-files github action +1 moretj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.8.6 High
@swiggy-private/aatm-nirbhar-buildnpmWithdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-buildNo score@swiggy-private/analyticsnpmWithdrawn Advisory: Malware in @swiggy-private/analyticsNo score@swiggy-private/aatm-nirbhar-uinpmWithdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-uiNo score@swiggy-private/aatm-nirbhar-bharat-uinpmWithdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-bharat-uiNo score@swiggy-private/dls-web-corenpmWithdrawn Advisory: Malware in @swiggy-private/dls-web-coreNo score@swiggy-private/js-utilsnpmWithdrawn Advisory: Malware in @swiggy-private/js-utilsNo score@solana/web3.jsnpmDuplicate Advisory: Malware in @solana/web3.jsNo score- javs viewerMalicious Code in Justice AV Solutions (JAVS) Viewer8.7 High
- tukaani xz, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreXz: malicious code in distributed source10.0 Critical
@mendeley-internal/apinpmWithdrawn Advisory: Malware in @mendeley-internal/apiNo score- unitronics vision1210, vision1210 firmware +1 moreEmbedded malicious code vulnerability in Unitronics Vision12109.1 Critical
@8x8/oxygen-constantsnpmWithdrawn Advisory: Malware in @8x8/oxygen-constantsNo score- node-ipc project node-ipcMalicious Package9.8 Critical
rcnpmEmbedded malware in rcNo scorecoanpmEmbedded malware in coaNo score- ua-parser-js project ua-parser-jsua-parser-js Crypto Mining backdoor5.0 Medium
- pulsesecure psa-5000 firmware, psa-7000 firmware, supermicro x10sl7-f firmware +9 more +11 moreA vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000...2.3 Low
- microsoft exchange server, exchange server 2010 service pack 3, exchange server 2013 cumulative update 21 +24 more +26 moreMicrosoft Exchange Server Remote Code Execution Vulnerability7.8 High
- nodejs node, node.js, fedoraproject fedora +11 more +13 moreNode.js bad7.5 High
text-qrcodenpmEntropy Backdoor in text-qrcode9.8 Critical- chameleon mini live debugger project mini live debugger, maxieds chameleonminilivedebugger +1 morePotentially tampered sources on Play Store for Chameleon Mini Live Debugger9.3 Critical
- lodahs project lodahslodahs is malware8.8 High
event-streamnpm,flatmap-streamnpm +1 moreCritical severity vulnerability that affects event-stream and flatmap-stream9.8 Critical- discordi.js project discordi.js, hackerone discordi.js node module +1 morediscordi.js is malware7.3 High
- coffescript project coffescript, hackerone coffeescript node module +1 morecoffescript is malware7.5 High
- jquey project jquey, hackerone jquey node module +1 morejquey is malware7.5 High
- coffescript project coffescript, hackerone coffeescript node module +1 morecoffe-script is malware7.5 High
- cofeescript project cofeescript, hackerone coffeescript node module +1 morecofeescript is malware7.5 High
- npm-script-demo project npm-script-demo, hackerone npm-script-demo node module +1 morenpm-script-demo is malware9.8 Critical
- Show moreLoading…