Revisiting Third-Party Library Detection: a Ground Truth Dataset and Its Implications across Security Tasks

Accurate detection of third-party libraries TPLs is fundamental to Android security, supporting vulnerability tracking, malware detection, and supply chain auditing. Despite many proposed tools, their real-world effectiveness remains unclear.We present the first large-scale empirical study of ten...

Evaluating Diverse Feature Extraction Techniques of Multifaceted IoT Malware Analysis: a Survey

As IoT devices continue to proliferate, their reliability is increasingly constrained by security concerns. In response, researchers have developed diverse malware analysis techniques to detect and classify IoT malware. These techniques typically rely on extracting features at different levels fr...

Malicious code in newrelic-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc689df21770af17a368dc724b21526759afb6d21614e0f7eb0033ef0ce430ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

1965 Cryptanalysis Training Workbook Released by the NSA

In the early 1960s, National Security Agency cryptanalyst and cryptanalysis instructor Lambros D. Callimahos coined the term "Stethoscope" to describe a diagnostic computer program used to unravel the internal structure of pre-computer ciphertexts. The term appears in the newly declassified...

PT-2025-35523

Name of the Vulnerable Software and Affected Versions SonarQube versions 4 through 5.3.0 Description SonarQube is a static analysis solution for continuous code quality and security inspection. A command injection issue was identified in the SonarQube Scan GitHub Action. Untrusted input arguments...

MAL-2025-42133 Malicious code in eslint-plugin-rdv-insertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6a011f4c21be2958b339f3da564f192dce2329a2d29903a2b0f01933708d94a The OpenSSF Package Analysis project identified 'eslint-plugin-rdv-insertion' @ 7.99.99 npm as malicious. It is considered malicious because: -...

Malicious code in eslint-plugin-rdv-insertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6a011f4c21be2958b339f3da564f192dce2329a2d29903a2b0f01933708d94a The OpenSSF Package Analysis project identified 'eslint-plugin-rdv-insertion' @ 7.99.99 npm as malicious. It is considered malicious because: -...

MINI-WVW4-2FWP-PVW5

Bulletin has no description...

Malicious code in github_chatops_extensions (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6269b59c516350c690f7fdf09dff674c52173f38074e8ac6f7b012352851797b The OpenSSF Package Analysis project identified 'githubchatopsextensions' @ 0.5.2.96.g33cefed rubygems as malicious. It is considered malicious...

MAL-2025-46929 Malicious code in monolith-twirp-github-repositories (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6ab9bea194d9fa5ad57b833b09316a0c338a6beb920638e9aff880730969c89 The OpenSSF Package Analysis project identified 'monolith-twirp-github-repositories' @ 1.0.0 rubygems as malicious. It is considered malicious...

Malicious code in secret-scanning-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1465959a0117b88d5bd9a996a386b97399277821a3199d62026605750c8194b7 The OpenSSF Package Analysis project identified 'secret-scanning-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: -...

MAL-2025-46942 Malicious code in secret-scanning-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1465959a0117b88d5bd9a996a386b97399277821a3199d62026605750c8194b7 The OpenSSF Package Analysis project identified 'secret-scanning-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: -...

MAL-2025-46946 Malicious code in turboscan-client (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aadd88a4cebcc045db4b6899180a44c571f6429b26ead528721f7474c03110a0 The OpenSSF Package Analysis project identified 'turboscan-client' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in turboscan-client (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aadd88a4cebcc045db4b6899180a44c571f6429b26ead528721f7474c03110a0 The OpenSSF Package Analysis project identified 'turboscan-client' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in proto-education-web (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe0791b8a3d9af1c4b04c567db2fc37ae9cbacd29a4ace0c5e07b75720f6c718 The OpenSSF Package Analysis project identified 'proto-education-web' @ 0.0.7.ref8a4ad331 rubygems as malicious. It is considered malicious...

Malicious code in proto-dependabot-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 020a9f64907bc95144ea451f388a29465ae090673bbbcc3adcabe76b5862bf73 The OpenSSF Package Analysis project identified 'proto-dependabot-api' @ 1.1.3.r8cdd21224 rubygems as malicious. It is considered malicious...

Malicious code in monolith-twirp-git_src_migrator-monolith (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 060f3ebfeb0862be79294c75a97aaa823e0378ae4ef10ce1910472c923b31dc3 The OpenSSF Package Analysis project identified 'monolith-twirp-gitsrcmigrator-monolith' @ 1.6.3 rubygems as malicious. It is considered malicio...

MAL-2025-46928 Malicious code in monolith-twirp-git_src_migrator-monolith (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 060f3ebfeb0862be79294c75a97aaa823e0378ae4ef10ce1910472c923b31dc3 The OpenSSF Package Analysis project identified 'monolith-twirp-gitsrcmigrator-monolith' @ 1.6.3 rubygems as malicious. It is considered malicio...

MAL-2025-46953 Malicious code in monolith-twirp-modelsgateway-access (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 313f573490a41070ababd4ac29e426b2b2d8f55dad52ab7068111a56bf582faf The OpenSSF Package Analysis project identified 'monolith-twirp-modelsgateway-access' @ 1.4.0 rubygems as malicious. It is considered malicious...

MAL-2025-46949 Malicious code in monolith-twirp-features-featuresync (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f53c57dca1a60f5e0bcea26028d79bc5d8f4427b2dfb2dc1c29c9babe625a2bb The OpenSSF Package Analysis project identified 'monolith-twirp-features-featuresync' @ 1.0.0 rubygems as malicious. It is considered malicious...