Skip to content
OpenAdvisories

Weakness (CWE)

CWE-506: Embedded Malicious Code

Class Incomplete

The product contains code that appears to be malicious in nature.

How to prevent it (1 mitigation)

  1. Implementation, Operation

    Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

Source: MITRE CWE-506

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware Public exploit

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack solid-start vue-start react-start npm
    KEV May 27, 2026
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • High 7.5
    CVE-2025-54313 Exploited Public exploit

    eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

    eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

    prettier eslint-config-prettier eslint-plugin-prettier @pkgr/core npm
    KEV Jan 22, 2026
  • High 8.6
    CVE-2025-30066 Exploited Public exploit EPSS 72%

    tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…

    tj-actions changed-files tj-actions/changed-files GitHub Actions
    KEV Mar 18, 2025