# CWE-506. Every Advisory and CVE whose sources give the weakness CWE-506, newest first. ## Records, newest first (an older page) - [backslash\@0.2.1 contains malware after npm account takeover](https://agentprime.io/advisories/CVE-2025-59140.md) `CVE-2025-59140` · CVE record: Qix- node-backslash · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-506 - [MetaMask SDK indirectly exposed via malicious debug\@4.4.2 dependency](https://agentprime.io/advisories/GHSA-qj3p-xc97-xw74.md) `GHSA-qj3p-xc97-xw74` · npm `@metamask/sdk` and 2 more: affected `>=0.16.0, <0.33.1`, fixed in `0.33.1` · No CVSS score · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-506 - [Prebid-universal-creative latest on npm briefly compromised](https://agentprime.io/advisories/GHSA-m662-56rj-8fmm.md) `GHSA-m662-56rj-8fmm`, `CVE-2025-59039` · npm `prebid-universal-creative`: affected `=1.17.3`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-506 - [Prebid.js NPM package briefly compromised](https://agentprime.io/advisories/CVE-2025-59038.md) `CVE-2025-59038` · CVE record: prebid Prebid.js · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-506 - [DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware](https://agentprime.io/advisories/GHSA-w62p-hx95-gf2c.md) `GHSA-w62p-hx95-gf2c`, `CVE-2025-59037` · npm `duckdb` and 3 more: affected `>=1.3.3, <1.3.4`, fixed in `1.3.4` · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-506 - [Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension](https://agentprime.io/advisories/CVE-2025-8217.md) `CVE-2025-8217` · CVE record: Amazon Q Developer VS Code Extension · CVSS 5.1 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: CWE-506 - [eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code](https://agentprime.io/advisories/GHSA-f29h-pxvx-f335.md) `GHSA-f29h-pxvx-f335`, `CVE-2025-54313` · npm `eslint-config-prettier` and 5 more: affected `>=8.10.1, <8.10.2 || >=9.1.1, <9.1.2 || >=10.1.6, <10.1.8`, fixed in `8.10.2`, `9.1.2`, `10.1.8` · CVSS 7.5 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 19 Jul 2025 · Tags: CWE-506 - [Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2](https://agentprime.io/advisories/GHSA-33qr-m49q-rxfx.md) `GHSA-33qr-m49q-rxfx`, `CVE-2025-32965` · npm `xrpl`: affected `>=2.14.2, <2.14.3 || >=4.2.1, <4.2.5`, fixed in `2.14.3`, `4.2.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2025 · Tags: CWE-506 - [Multiple Reviewdog actions were compromised during a specific time period](https://agentprime.io/advisories/CVE-2025-30154.md) `CVE-2025-30154` · CVE record: reviewdog reviewdog · CVSS 8.6 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-506 - [tj-actions changed-files: tj-actions changed-files before 46 allows remote attackers to discover secrets by reading…](https://agentprime.io/advisories/CVE-2025-30066.md) `CVE-2025-30066` · CVE record: tj-actions changed-files · CVSS 8.6 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.72 · Not analysed yet · Published 15 Mar 2025 · Tags: CWE-506 - [Malicious Code in Justice AV Solutions (JAVS) Viewer](https://agentprime.io/advisories/CVE-2024-4978.md) `CVE-2024-4978` · CVE record: Justice AV Solutions Viewer · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.27 · Not analysed yet · Published 23 May 2024 · Tags: CWE-506 - [Xz: malicious code in distributed source](https://agentprime.io/advisories/CVE-2024-3094.md) `CVE-2024-3094` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.91 · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-506 - [Embedded malicious code vulnerability in Unitronics Vision1210](https://agentprime.io/advisories/CVE-2023-2003.md) `CVE-2023-2003` · CVE record: Unitronics Vision1210 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-506 - [Malware in pre-build binaries of bignum](https://agentprime.io/advisories/GHSA-7cgc-fjv4-52x6.md) `GHSA-7cgc-fjv4-52x6` · npm `bignum`: affected `>=0.12.2, <0.13.1`, fixed in `0.13.1` · No CVSS score · Not analysed yet · Published 24 May 2023 · Tags: CWE-506 - [Embedded Malicious Code in node-ipc](https://agentprime.io/advisories/GHSA-97m3-w2cp-4xx6.md) `GHSA-97m3-w2cp-4xx6`, `CVE-2022-23812` · npm `node-ipc`: affected `>=10.1.1, <10.1.3`, fixed in `10.1.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Mar 2022 · Tags: Code injection, CWE-506 - [Embedded malware in rc](https://agentprime.io/advisories/GHSA-g2q5-5433-rhrf.md) `GHSA-g2q5-5433-rhrf` · npm `rc`: affected `=1.2.9 || =1.3.9 || =2.3.9`, no fixed version yet · No CVSS score · Not analysed yet · Published 4 Nov 2021 · Tags: CWE-506 - [Embedded malware in coa](https://agentprime.io/advisories/GHSA-73qr-pfmq-6rp8.md) `GHSA-73qr-pfmq-6rp8` · npm `coa`: affected `=2.0.3 || =2.0.4 || =2.1.1 || =2.1.3 || =3.0.1 || =3.1.3`, no fixed version yet · No CVSS score · Not analysed yet · Published 4 Nov 2021 · Tags: CWE-506 - [Embedded malware in ua-parser-js](https://agentprime.io/advisories/GHSA-pjwm-rvh2-c87w.md) `GHSA-pjwm-rvh2-c87w`, `CVE-2021-4229` · npm `ua-parser-js`: affected `>=0.7.29, <0.7.30 || >=0.8.0, <0.8.1 || >=1.0.0, <1.0.1`, fixed in `0.7.30`, `0.8.1`, `1.0.1` · CVSS 5.0 Medium · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-506, CWE-912 - [A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware.](https://agentprime.io/advisories/CVE-2021-22887.md) `CVE-2021-22887` · CVE record: PSA5000, PSA7000 · No CVSS score · Not analysed yet · Published 16 Mar 2021 · Tags: CWE-506 - [Malicious npm package: an0n-chat-lib](https://agentprime.io/advisories/GHSA-7xcv-wvr7-4h6p.md) `GHSA-7xcv-wvr7-4h6p` · npm `an0n-chat-lib`: affected `>=0.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 29 Jan 2021 · Tags: CWE-506 - [Malicious npm package: discord-fix](https://agentprime.io/advisories/GHSA-qv2g-99x4-45x6.md) `GHSA-qv2g-99x4-45x6` · npm `discord-fix`: affected `>=0.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 29 Jan 2021 · Tags: CWE-506 - [Malicious npm package: sonatype](https://agentprime.io/advisories/GHSA-w8fh-pvq2-x8c4.md) `GHSA-w8fh-pvq2-x8c4` · npm `sonatype`: affected `>=0.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 29 Jan 2021 · Tags: CWE-506 - [Malicious code in \`loadyaml\`](https://agentprime.io/advisories/GHSA-mfc2-93pr-jf92.md) `GHSA-mfc2-93pr-jf92` · npm `loadyaml`: affected `<=1.0.2`, no fixed version yet · No CVSS score · Not analysed yet · Published 1 Oct 2020 · Tags: CWE-506 - [Malicious code in \`electorn\`](https://agentprime.io/advisories/GHSA-38hx-3542-8fh3.md) `GHSA-38hx-3542-8fh3` · npm `electorn`: affected `<=10.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 1 Oct 2020 · Tags: CWE-506 - [Malicious Package in motiv.scss](https://agentprime.io/advisories/GHSA-2vqq-jgxx-fxjc.md) `GHSA-2vqq-jgxx-fxjc` · npm `motiv.scss`: affected `>=0.4.20, <0.4.21`, fixed in `0.4.21` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in react-datepicker-plus](https://agentprime.io/advisories/GHSA-4wcx-c9c4-89p2.md) `GHSA-4wcx-c9c4-89p2` · npm `react-datepicker-plus`: affected `>=2.4.2, <2.4.6`, fixed in `2.4.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in ng-ui-library](https://agentprime.io/advisories/GHSA-2xw5-3767-qxvm.md) `GHSA-2xw5-3767-qxvm` · npm `ng-ui-library`: affected `>=1.0.987, <1.0.990`, fixed in `1.0.990` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in test-module-a](https://agentprime.io/advisories/GHSA-76xq-58hj-vwm2.md) `GHSA-76xq-58hj-vwm2` · npm `test-module-a`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in epress](https://agentprime.io/advisories/GHSA-vf8q-pw7h-r2x2.md) `GHSA-vf8q-pw7h-r2x2` · npm `epress`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in commmander](https://agentprime.io/advisories/GHSA-q42c-rrp3-r3xm.md) `GHSA-q42c-rrp3-r3xm` · npm `commmander`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in blubird](https://agentprime.io/advisories/GHSA-rvww-x6m4-4vc2.md) `GHSA-rvww-x6m4-4vc2` · npm `blubird`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in equest](https://agentprime.io/advisories/GHSA-mvch-rh6h-2m47.md) `GHSA-mvch-rh6h-2m47` · npm `equest`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in commqnder](https://agentprime.io/advisories/GHSA-4xgp-xrg3-c73w.md) `GHSA-4xgp-xrg3-c73w` · npm `commqnder`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in reuest](https://agentprime.io/advisories/GHSA-r863-p739-275c.md) `GHSA-r863-p739-275c` · npm `reuest`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in angluar-cli](https://agentprime.io/advisories/GHSA-8mm3-2mcj-cx6r.md) `GHSA-8mm3-2mcj-cx6r` · npm `angluar-cli`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in shrugging-logging](https://agentprime.io/advisories/GHSA-qv78-398w-cxp7.md) `GHSA-qv78-398w-cxp7` · npm `shrugging-logging`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in requst](https://agentprime.io/advisories/GHSA-8qx4-r7fx-xc4v.md) `GHSA-8qx4-r7fx-xc4v` · npm `requst`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-506 - [Malicious Package in 1337qq-js](https://agentprime.io/advisories/GHSA-7wgh-5q4q-6wx5.md) `GHSA-7wgh-5q4q-6wx5` · npm `1337qq-js`: affected `>=0.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bs85check](https://agentprime.io/advisories/GHSA-4hq8-v42x-9wx3.md) `GHSA-4hq8-v42x-9wx3` · npm `bs85check`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bs58chcek](https://agentprime.io/advisories/GHSA-97mp-9g5c-6c93.md) `GHSA-97mp-9g5c-6c93` · npm `bs58chcek`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bs58chek](https://agentprime.io/advisories/GHSA-3cpj-mj3q-82wr.md) `GHSA-3cpj-mj3q-82wr` · npm `bs58chek`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bpi66](https://agentprime.io/advisories/GHSA-7xc4-793x-25jp.md) `GHSA-7xc4-793x-25jp` · npm `bpi66`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bpi39](https://agentprime.io/advisories/GHSA-762c-v946-pf25.md) `GHSA-762c-v946-pf25` · npm `bpi39`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bp66](https://agentprime.io/advisories/GHSA-8gc6-65mm-xr6r.md) `GHSA-8gc6-65mm-xr6r` · npm `bp66`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcroe-lib](https://agentprime.io/advisories/GHSA-4m3p-x2hp-2pgx.md) `GHSA-4m3p-x2hp-2pgx` · npm `bitcroe-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitconijs-lib](https://agentprime.io/advisories/GHSA-74hh-4rcv-pp27.md) `GHSA-74hh-4rcv-pp27` · npm `bitconijs-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitconi-ops](https://agentprime.io/advisories/GHSA-w9hw-v97w-g5f5.md) `GHSA-w9hw-v97w-g5f5` · npm `bitconi-ops`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitconid-rpc](https://agentprime.io/advisories/GHSA-9298-m7jf-55h2.md) `GHSA-9298-m7jf-55h2` · npm `bitconid-rpc`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcoisnj-lib](https://agentprime.io/advisories/GHSA-629c-j867-3v45.md) `GHSA-629c-j867-3v45` · npm `bitcoisnj-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcoin-sweep](https://agentprime.io/advisories/GHSA-8hqw-qp6r-vqcm.md) `GHSA-8hqw-qp6r-vqcm` · npm `bitcoin-sweep`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcoin-osp](https://agentprime.io/advisories/GHSA-v8g7-9qv2-j865.md) `GHSA-v8g7-9qv2-j865` · npm `bitcoin-osp`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcoimjs-lib](https://agentprime.io/advisories/GHSA-rv6q-p3x7-43fx.md) `GHSA-rv6q-p3x7-43fx` · npm `bitcoimjs-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcoimd-rpc](https://agentprime.io/advisories/GHSA-rwmv-c7v8-v9vf.md) `GHSA-rwmv-c7v8-v9vf` · npm `bitcoimd-rpc`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcoijns-lib](https://agentprime.io/advisories/GHSA-37vc-gwvp-6cgv.md) `GHSA-37vc-gwvp-6cgv` · npm `bitcoijns-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcionjslib](https://agentprime.io/advisories/GHSA-p4mf-4qvh-w8g5.md) `GHSA-p4mf-4qvh-w8g5` · npm `bitcionjslib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcionjs](https://agentprime.io/advisories/GHSA-qmgf-fp85-55gr.md) `GHSA-qmgf-fp85-55gr` · npm `bitcionjs`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bitcion-ops](https://agentprime.io/advisories/GHSA-85q4-v37c-wfpc.md) `GHSA-85q4-v37c-wfpc` · npm `bitcion-ops`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bictore-lib](https://agentprime.io/advisories/GHSA-f8vf-6hwg-hw55.md) `GHSA-f8vf-6hwg-hw55` · npm `bictore-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bip30](https://agentprime.io/advisories/GHSA-wch2-46wj-6x5j.md) `GHSA-wch2-46wj-6x5j` · npm `bip30`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 - [Malicious Package in bictoinjs-lib](https://agentprime.io/advisories/GHSA-hwh3-fhf6-73x9.md) `GHSA-hwh3-fhf6-73x9` · npm `bictoinjs-lib`: affected `>=0.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-506 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .