CWE-506: Embedded Malicious Code

The product contains code that appears to be malicious in nature.

Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.

Consequences

• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands

How to prevent it

• Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

Recent advisories

• CVE-2026-48027 — Compromised Nx Console version 18.95.0
• CVE-2026-8398 — A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…
• GHSA-g7cv-rxg3-hmpx — Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
• GHSA-5mg7-485q-xm76 — Two LiteLLM versions published containing credential harvesting malware
• GHSA-69fq-xp46-6x23 — Trivy ecosystem supply chain was briefly compromised
• CVE-2025-59374 — "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…
• GHSA-pxx3-g568-hxr4 — color-convert@3.1.1 contains malware after npm account takeover
• GHSA-5fvm-p68v-5wmh — color-name@2.0.1 contains malware after npm account takeover
• GHSA-4x49-vf9v-38px — debug@4.4.2 contains malware after npm account takeover
• GHSA-f29h-pxvx-f335 — eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
• GHSA-qmg3-hpqr-gqvc — Multiple Reviewdog actions were compromised during a specific time period
• GHSA-mrrh-fwg8-r2c3 — tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
• CVE-2024-4978 — Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature.
• GHSA-hxxf-q3w9-4xgw — Malicious Package in eslint-scope

All advisories for CWE-506