Charlie Eriksen

The npm publishing account for debug was compromised following a phishing attack on September 8, 2025. Version 4.4.2 was published with a malicious payload designed to redirect cryptocurrency transactions within browser environments. Environments not utilizing the package in a browser context, such as local, server, or command-line applications, are not affected. The malware specifically targets cryptocurrency transactions and wallets like MetaMask.

DuckDB packages distributed for Node.js on npm were compromised with malware intended to interfere with cryptocoin transactions. An attacker published malicious versions of several DuckDB packages. The attack involved a phishing campaign targeting DuckDB administrators, leading to the compromise of npm credentials and the publication of malicious packages. The attacker created a convincing replica of the npm website to steal credentials.

A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that add calendar entries.

The issue allows remote attackers to execute arbitrary code. This can be achieved via a YAML document in two parameters: the `namespace` parameter to the `deobfuscation` function or the `sourcemap` parameter to the `sourcemap` function, both located in the `app/controllers/api/v1 controller.rb` file.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings.

The issue is related to a cross-site request forgery (CSRF) vulnerability. This allows remote attackers to hijack the authentication of administrators for requests that deactivate a plugin. The exact vectors used for the attack are not specified.

The issue concerns the use of the pickle Python module in an unsafe manner by the renderLocalView function in render/views.py in graphite-web. This allows remote attackers to execute arbitrary code via a crafted serialized object.

A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users for requests that modify the plugin's settings.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the `callback` parameter.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the `callback` parameter in a `lostpassword` action to `wp-login.php`.