Weakness (CWE)
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it (1 mitigation)
-
Implementation, Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Source: MITRE CWE-506
53 results · Clear filters · Feed
-
High 7.8
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a h…
-
High 8.1CVE-2026-67595 Public exploit
VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affecte…
-
High 8.8
color-name@2.0.1 contains malware after npm account takeover
color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload adde…
-
High 8.8
is-arrayish@0.3.3 contains malware after npm account takeover
is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a mal…
-
High 8.8
error-ex@1.3.3 contains malware after npm account takeover
error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malwar…
-
High 8.8
color-convert@3.1.1 contains malware after npm account takeover
color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version,…
-
High 8.8
color-string@2.1.1 contains malware after npm account takeover
color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with …
-
High 8.8
debug@4.4.2 contains malware after npm account takeover
debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added atte…
-
High 8.8
color@5.0.1 contains malware after npm account takeover
color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a ma…
-
High 8.8
simple-swizzle@0.2.3 contains malware after npm account takeover
simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payloa…
-
High 8.8
backslash@0.2.1 contains malware after npm account takeover
backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload…
-
High 8.6
Prebid.js NPM package briefly compromised
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the …
-
High 8.6
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packag…
-
High 7.5
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
KEV Jan 22, 2026 -
High 8.6CVE-2025-30154 Exploited
Multiple Reviewdog actions were compromised during a specific time period
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog act…
KEV Mar 24, 2025 -
High 8.6
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…
KEV Mar 18, 2025 -
High 8.4
Malicious Code in Justice AV Solutions (JAVS) Viewer
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
KEV May 29, 2024 -
High 8.8
lodahs is malware
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
-
High 7.5
mssql.js is malware
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
babelcli is malware
babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
crossenv is malware
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
nodemailer-js is malware
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
node-opensl is malware
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
coffescript is malware
The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
High 7.5
openssl.js is malware
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
http-proxy.js is malware
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
mongose is malware
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
opencv.js is malware
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
smb is malware
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
mssql-node is malware
mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
nodemssql is malware
nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
node-opencv is malware
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
nodemailer.js is malware
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
nodeffmpeg is malware
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
nodecaffe is malware
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
gruntcli is malware
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.3
discordi.js is malware
discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.
-
High 7.5
coffe-script is malware
The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
High 7.5
node-openssl is malware
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
ffmepg is malware
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.