Advisories · Weakness
CWE-506.
Every Advisory and CVE whose sources give the weakness CWE-506, newest first.
- CVSS 8.8 High
[email protected] contains malware after npm account takeover
- Qix- node-backslash
- CWE-506
-
MetaMask SDK indirectly exposed via malicious [email protected] dependency
- CWE-506
>=0.16.0, <0.33.1 · fixed in 0.33.1
GHSA-qj3p-xc97-xw74 - CVSS 9.3 CriticalCritical · CVSS 9+
Prebid-universal-creative latest on npm briefly compromised
- CWE-506
=1.17.3 · no fixed version yet
GHSA-m662-56rj-8fmm · CVE-2025-59039 - CVSS 8.6 High
Prebid.js NPM package briefly compromised
- Prebid.js
- CWE-506
- CVSS 8.6 High
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
- CWE-506
>=1.3.3, <1.3.4 · fixed in 1.3.4
GHSA-w62p-hx95-gf2c · CVE-2025-59037 - CVSS 5.1 Medium
Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension
- Amazon Q Developer VS Code Extension
- CWE-506
- CVSS 7.5 HighCritical · KEVKEV
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
- CWE-506
>=8.10.1, <8.10.2 || >=9.1.1, <9.1.2 || >=10.1.6, <10.1.8 · fixed in 8.10.2, 9.1.2, 10.1.8
GHSA-f29h-pxvx-f335 · CVE-2025-54313 - CVSS 9.3 CriticalCritical · CVSS 9+
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
- CWE-506
>=2.14.2, <2.14.3 || >=4.2.1, <4.2.5 · fixed in 2.14.3, 4.2.5
GHSA-33qr-m49q-rxfx · CVE-2025-32965 - CVSS 8.6 HighCritical · KEVKEV
Multiple Reviewdog actions were compromised during a specific time period
- reviewdog
- CWE-506
- CVSS 8.6 HighCritical · KEV, CVSS 7+ and EPSSKEV
tj-actions changed-files: tj-actions changed-files before 46 allows remote attackers to discover secrets by reading…
- tj-actions changed-files
- CWE-506
- CVSS 8.7 HighCritical · KEV, CVSS 7+ and EPSSKEV
Malicious Code in Justice AV Solutions (JAVS) Viewer
- Justice AV Solutions Viewer
- CWE-506
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Xz: malicious code in distributed source
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-506
- CVSS 9.1 CriticalCritical · CVSS 9+
Embedded malicious code vulnerability in Unitronics Vision1210
- Unitronics Vision1210
- CWE-506
-
Malware in pre-build binaries of bignum
- CWE-506
>=0.12.2, <0.13.1 · fixed in 0.13.1
GHSA-7cgc-fjv4-52x6 - CVSS 9.8 CriticalCritical · CVSS 9+
Embedded Malicious Code in node-ipc
- Code injection
- CWE-506
>=10.1.1, <10.1.3 · fixed in 10.1.3
GHSA-97m3-w2cp-4xx6 · CVE-2022-23812 -
Embedded malware in rc
- CWE-506
=1.2.9 || =1.3.9 || =2.3.9 · no fixed version yet
GHSA-g2q5-5433-rhrf -
Embedded malware in coa
- CWE-506
=2.0.3 || =2.0.4 || =2.1.1 || =2.1.3 || =3.0.1 || =3.1.3 · no fixed version yet
GHSA-73qr-pfmq-6rp8 - CVSS 5.0 Medium
Embedded malware in ua-parser-js
- CWE-506
- CWE-912
>=0.7.29, <0.7.30 || >=0.8.0, <0.8.1 || >=1.0.0, <1.0.1 · fixed in 0.7.30, 0.8.1, 1.0.1
GHSA-pjwm-rvh2-c87w · CVE-2021-4229 -
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware.
- PSA5000, PSA7000
- CWE-506
-
Malicious npm package: an0n-chat-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-7xcv-wvr7-4h6p -
Malicious npm package: discord-fix
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-qv2g-99x4-45x6 -
Malicious npm package: sonatype
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-w8fh-pvq2-x8c4 -
Malicious code in `loadyaml`
- CWE-506
<=1.0.2 · no fixed version yet
GHSA-mfc2-93pr-jf92 -
Malicious code in `electorn`
- CWE-506
<=10.0.0 · no fixed version yet
GHSA-38hx-3542-8fh3 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in motiv.scss
- CWE-506
>=0.4.20, <0.4.21 · fixed in 0.4.21
GHSA-2vqq-jgxx-fxjc - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in react-datepicker-plus
- CWE-506
>=2.4.2, <2.4.6 · fixed in 2.4.6
GHSA-4wcx-c9c4-89p2 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in ng-ui-library
- CWE-506
>=1.0.987, <1.0.990 · fixed in 1.0.990
GHSA-2xw5-3767-qxvm - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in test-module-a
- CWE-506
* · no fixed version yet
GHSA-76xq-58hj-vwm2 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in epress
- CWE-506
* · no fixed version yet
GHSA-vf8q-pw7h-r2x2 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in commmander
- CWE-506
* · no fixed version yet
GHSA-q42c-rrp3-r3xm - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in blubird
- CWE-506
* · no fixed version yet
GHSA-rvww-x6m4-4vc2 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in equest
- CWE-506
* · no fixed version yet
GHSA-mvch-rh6h-2m47 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in commqnder
- CWE-506
* · no fixed version yet
GHSA-4xgp-xrg3-c73w - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in reuest
- CWE-506
* · no fixed version yet
GHSA-r863-p739-275c - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in angluar-cli
- CWE-506
* · no fixed version yet
GHSA-8mm3-2mcj-cx6r - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in shrugging-logging
- CWE-506
* · no fixed version yet
GHSA-qv78-398w-cxp7 - CVSS 9.8 CriticalCritical · CVSS 9+
Malicious Package in requst
- CWE-506
* · no fixed version yet
GHSA-8qx4-r7fx-xc4v -
Malicious Package in 1337qq-js
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-7wgh-5q4q-6wx5 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bs85check
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-4hq8-v42x-9wx3 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bs58chcek
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-97mp-9g5c-6c93 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bs58chek
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-3cpj-mj3q-82wr - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bpi66
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-7xc4-793x-25jp - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bpi39
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-762c-v946-pf25 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bp66
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-8gc6-65mm-xr6r - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcroe-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-4m3p-x2hp-2pgx - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitconijs-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-74hh-4rcv-pp27 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitconi-ops
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-w9hw-v97w-g5f5 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitconid-rpc
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-9298-m7jf-55h2 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcoisnj-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-629c-j867-3v45 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcoin-sweep
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-8hqw-qp6r-vqcm - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcoin-osp
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-v8g7-9qv2-j865 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcoimjs-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-rv6q-p3x7-43fx - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcoimd-rpc
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-rwmv-c7v8-v9vf - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcoijns-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-37vc-gwvp-6cgv - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcionjslib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-p4mf-4qvh-w8g5 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcionjs
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-qmgf-fp85-55gr - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bitcion-ops
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-85q4-v37c-wfpc - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bictore-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-f8vf-6hwg-hw55 - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bip30
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-wch2-46wj-6x5j - CVSS 9.1 CriticalCritical · CVSS 9+
Malicious Package in bictoinjs-lib
- CWE-506
>=0.0.0 · no fixed version yet
GHSA-hwh3-fhf6-73x9