CWE-506 · Supply Chain and Malicious Code
Embedded Malicious Code
103CVEs
9exploited
1with a public check
1likely (EPSS 10%+)
SortMost likely exploited
103 CVEs with CWE-506 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-30066In CISA KEVExploitedtj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 bec…tj-actions · changed-files · CVSS 8.6 · 2025-03-15 | 8.6 | 72% | 2025-03-15 |
| CVE-2026-33634In CISA KEVExploitedTrivy ecosystem supply chain briefly compromisedaquasecurity · setup-trivy · CVSS 9.4 · 2026-03-23 | 9.4 | 62% | 2026-03-23 |
| CVE-2024-4978In CISA KEVExploitedMalicious Code in Justice AV Solutions (JAVS) ViewerJustice AV Solutions · Viewer · CVSS 8.4 · 2024-05-23 | 8.4 | 27% | 2024-05-23 |
| CVE-2025-54313In CISA KEVExploitedeslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that…prettier · eslint-config-prettier · CVSS 7.5 · 2025-07-19 | 7.5 | 5.1% | 2025-07-19 |
| CVE-2026-45321In CISA KEVExploitedMalware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys@tanstack · arktype-adapter · CVSS 9.6 · 2026-05-12 | 9.6 | 3.3% | 2026-05-12 |
| CVE-2025-30154In CISA KEVExploitedMultiple Reviewdog actions were compromised during a specific time periodreviewdog · reviewdog · CVSS 8.6 · 2025-03-19 | 8.6 | 2.5% | 2025-03-19 |
| CVE-2026-48027In CISA KEVExploitedCompromised Nx Console version 18.95.0nrwl · nx-console · CVSS 9.3 · 2026-05-27 | 9.3 | 1.8% | 2026-05-27 |
| CVE-2026-8398In CISA KEVExploitedA supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate websi…AVB Disc Soft · DAEMON Tools Lite · CVSS 9.8 · 2026-05-15 | 9.8 | 1.5% | 2026-05-15 |
| CVE-2025-59374In CISA KEVExploited"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modi…ASUS · live update · CVSS 9.3 · 2025-12-17 | 9.3 | 1.2% | 2025-12-17 |
| CVE-2026-18072CheckAdvanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypassnico23 · Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … · CVSS 9.8 · 2026-07-29 | 9.8 | 3.0% | 2026-07-29 |
| CVE-2024-3094Xz: malicious code in distributed sourceRedhat · xz · CVSS 10 · 2024-03-29 | 10.0 | 91% | 2024-03-29 |
| CVE-2017-16128The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.HackerOne · npm-script-demo node module · 2018-06-07 | – | 1.4% | 2018-06-07 |
| CVE-2017-16044`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · d3.js node module · 2018-06-04 | – | 1.4% | 2018-06-04 |
| CVE-2020-15165Potentially tampered sources on Play Store for Chameleon Mini Live Debuggermaxieds · ChameleonMiniLiveDebugger · CVSS 9.3 · 2020-08-28 | 9.3 | 1.3% | 2020-08-28 |
| CVE-2017-16081cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · cross-env.js node module · 2018-06-07 | – | 1.3% | 2018-06-07 |
| CVE-2017-16047mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · mysqljs node module · 2018-05-29 | – | 1.2% | 2018-05-29 |
| CVE-2017-16051`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · sqliter node module · 2018-06-04 | – | 1.2% | 2018-06-04 |
| CVE-2017-16077mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · mongose node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16202The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.HackerOne · coffeescript node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16075http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · http-proxy.js node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16074crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · crossenv node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16072nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodemailer.js node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16070nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodecaffe node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16069nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodeffmpeg node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16068ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · ffmepg node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16065openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · openssl.js node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16064node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · node-openssl node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16060babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · babelcli node module · 2018-06-07 | – | 1.2% | 2018-06-07 |
| CVE-2017-16054`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodefabric node module · 2018-06-04 | – | 1.1% | 2018-06-04 |
| CVE-2017-16052`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · node-fabric node module · 2018-06-04 | – | 1.1% | 2018-06-04 |
| CVE-2017-16049`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodesqlite node module · 2018-06-04 | – | 1.1% | 2018-06-04 |
| CVE-2017-16048`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · node-sqlite node module · 2018-06-04 | – | 1.1% | 2018-06-04 |
| CVE-2017-16046`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · mariadb node module · 2018-06-04 | – | 1.1% | 2018-06-04 |
| CVE-2017-16205The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.HackerOne · coffeescript node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16204The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.HackerOne · jquey node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16203The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.HackerOne · coffeescript node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16080nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodesass node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16079smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · smb node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16078shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · shadowsock node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16076proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · proxy.js node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16073noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · noderequest node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16071nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodemailer-js node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16067node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · node-opencv node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16066opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · opencv.js node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16063node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · node-opensl node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16059mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · mssql-node node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16058gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · gruntcli node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16057nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · nodemssql node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16056mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · mssql.js node module · 2018-06-07 | – | 1.1% | 2018-06-07 |
| CVE-2017-16061tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.HackerOne · tkinter node module · 2018-05-29 | – | 1.1% | 2018-05-29 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.