Weaknesses of type CWE-506

101 results

Código malicioso embutido

É quando código malicioso ou prejudicial é intencionalmente inserido em um software legítimo, seja por um desenvolvedor comprometido, uma dependência infectada ou um processo de build comprometido. O risco é que a aplicação executa ações maliciosas (roubo de dados, backdoor, espionagem) sem que o usuário ou mesmo a organização responsável saiba.

Example

Um desenvolvedor adiciona silenciosamente um trecho que envia credenciais de usuários para um servidor externo, ou uma biblioteca open-source popular é comprometida e passa a incluir código que minera criptomoredas nos servidores das empresas que a usam.

How to mitigate

Implementar revisão de código rigorosa e segregação de acesso (principle of least privilege), auditar dependências e versões de bibliotecas, usar integridade de artefatos (assinatura de pacotes, SBOM), e monitorar comportamento anômalo em execução (logs, atividade de rede). Também: manter cadeia de custódia clara do código-fonte e pipeline de build seguro.

CVE-2025-59144HIGHdebug@4.4.2 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59143HIGHcolor@5.0.1 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59330HIGHerror-ex@1.3.3 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59141HIGHsimple-swizzle@0.2.3 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59162HIGHcolor-convert@3.1.1 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59142HIGHcolor-string@2.1.1 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59140HIGHbackslash@0.2.1 contains malware after npm account takeoverEPSS 0.4%CVE-2025-59331HIGHis-arrayish@0.3.3 contains malware after npm account takeoverEPSS 0.4%CVE-2026-48158CRITICALuse-context-selector was vulnerable to malicious code execution via compromised commitsEPSS 0.4%CVE-2026-48160CRITICALreact-tracked was vulnerable to malicious code execution via compromised commitsEPSS 0.4%CVE-2026-44484CRITICALCompromise of PyTorch Lightning PyPi Package VersionsEPSS 0.4%CVE-2025-59037HIGHDuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malwareEPSS 0.4%CVE-2025-59038HIGHPrebid.js NPM package briefly compromisedEPSS 0.4%CVE-2025-59039CRITICALPrebid Universal Creative on npm briefly compromisedEPSS 0.3%CVE-2024-10938MEDIUMOVRI Payment 1.7.0 - Malicious .htaccess directiveEPSS 0.3%CVE-2026-45758CRITICALMalicious code in guardrails-ai 0.10.1 (supply chain compromise)EPSS 0.3%CVE-2021-22887—A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmEPSS 0.2%CVE-2026-34841CRITICALAxios npm Supply Chain Incident Impacting @usebruno/cliEPSS 0.2%CVE-2025-8217MEDIUMInert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) ExtensionEPSS 0.2%CVE-2025-55556MEDIUMTensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application.EPSS 0.2%