Malicious code in @ccfly/setup-darwin-arm64 (npm)

Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and github.com/creack/pty and contains hardcoded strings 'wss://', 'ws://ccfly',...

Malicious code in @ccfly/setup-linux-arm64 (npm)

Source: amazon-inspector faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec The package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty PTY spawner and github.com/gorilla/websocket alongside internal packages...

@ccfly/setup (0.1.0) potentially affected by unknown CVE via @ccfly/setup-linux-arm64 (0.1.0)

@ccfly/setup-linux-arm64 NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-arm64 and may be impacted: - @ccfly/setup 0.1.0 Source cves: unknown CVE Source advisory: GHSA-68FQ-2X3M-XH9H...

@ccfly/setup (0.1.2) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.2)

@ccfly/setup-darwin-arm64 NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.2 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.5) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.5)

@ccfly/setup-darwin-arm64 NPM version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.5 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.7) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.7)

@ccfly/setup-darwin-arm64 NPM version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.7 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.8) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.8)

@ccfly/setup-darwin-arm64 NPM version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.8 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.9)

@ccfly/setup-darwin-arm64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.10) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.10)

@ccfly/setup-darwin-arm64 NPM version 0.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.10 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.13) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.13)

@ccfly/setup-darwin-arm64 NPM version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.13 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.14) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.14)

@ccfly/setup-darwin-arm64 NPM version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.14 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.20) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.20)

@ccfly/setup-darwin-arm64 NPM version 0.1.20 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.20 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.0) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.0)

@ccfly/setup-linux-x64 NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.0 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.1) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.1)

@ccfly/setup-linux-x64 NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.1 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.2) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.2)

@ccfly/setup-linux-x64 NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.2 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.3) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.3)

@ccfly/setup-linux-x64 NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.3 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.4) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.4)

@ccfly/setup-linux-x64 NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.4 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.9)

@ccfly/setup-linux-x64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.10) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.10)

@ccfly/setup-linux-x64 NPM version 0.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.10 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...

@ccfly/setup (0.1.14) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.14)

@ccfly/setup-linux-x64 NPM version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.14 Source cves: unknown CVE Source advisory: GHSA-PCXF-5W7V-GX36...