Weakness (CWE)
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it (1 mitigation)
-
Implementation, Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Source: MITRE CWE-506
12 results · Clear filters · Feed
-
Medium 6.5
OVRI Payment 1.7.0 - Malicious .htaccess directive
The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directo…
-
Medium 6.5
TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in …
-
Medium —
MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency
### Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: - Installed MetaMask SDK into a pr…
-
Medium 4.0
Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension
The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syn…
-
Medium 5.0
ua-parser-js Crypto Mining backdoor
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommen…
-
Medium —
cofeescript is malware
The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
Medium —
Shadowsock is malware
shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Medium —
Hijacked Environment Variables in proxy.js
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Medium —
cross-env.js is malware
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Medium —
Nodesass is malware
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Medium —
jquey is malware
The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
Medium —
sqlite.js is malware
`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.