MAL-2024-12081 Malicious code in testbyakash2310please (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3ab898b094ec69febe5691ee0bb06b4040dc1dd9c9bb9632fd7b3d24d2b2870b The OpenSSF Package Analysis project identified 'testbyakash2310please' @ 69.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in phonepe-payment-capacitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d01542a7b9d2f9074bacbba74137fca1ea6f0a5e3a4539037d83dc529ff4d44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12077 Malicious code in layerzero-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e38548e48278e6b84fe1732117aef2c443aee26ea8e5694692002fe7342e1e30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12076 Malicious code in api-demo-sample-lib1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware feb4cdcfd09bde3632e5027efd5e0378c93e89ab16f9e0f0e931586d1679412d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12075 Malicious code in grafana-report-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8623412527e3e107cf7a8046c236118472390191d5e456e969b6c628b3d708fa The OpenSSF Package Analysis project identified 'grafana-report-panel' @ 2.0.0 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-12074 Malicious code in @rrvis/code-mapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 19a43a84b4d9f910d4a656a44cae41f44115366eb59777c6b6be77fd66de9fc8 The OpenSSF Package Analysis project identified '@rrvis/code-mapper' @ 99.99.3 npm as malicious. It is considered malicious because: - The packa...

Malicious code in yb2bacceleratorstorefront-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7d6b9ec48a872ef195c69f3ecee359b142d1f9bb683a236c67a0c96876efafd0 The OpenSSF Package Analysis project identified 'yb2bacceleratorstorefront-web' @ 1.0.0 npm as malicious. It is considered malicious because: -...

MAL-2024-12070 Malicious code in yb2bacceleratorstorefront-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7d6b9ec48a872ef195c69f3ecee359b142d1f9bb683a236c67a0c96876efafd0 The OpenSSF Package Analysis project identified 'yb2bacceleratorstorefront-web' @ 1.0.0 npm as malicious. It is considered malicious because: -...

BellaCPP: Discovering a new BellaCiao variant written in C++

Introduction BellaCiao is a .NET-based malware family that adds a unique twist to an intrusion, combining the stealthy persistence of a webshell with the power to establish covert tunnels. It surfaced for the first time in late April 2023 and has since been publicly attributed to the APT actor...

Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools

A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect. The vulnerability in question is CVE-2023-48788 CVSS score: 9.3, an SQL injection bu...

MAL-2024-12067 Malicious code in aauto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ef1fe2d72d5632ea92996b145c4713780023fe149d21e2f24e5ba190caf8100 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11929 Malicious code in @rrvis/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis feaaf40ea5d1af97c31051295c594dc2344a3337d6b9aba3e9ae1ed6451001f0 The OpenSSF Package Analysis project identified '@rrvis/ui' @ 99.99.2 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11928 Malicious code in @rrvis/logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11fa65d69306fc86aca5bb9af5b91bc3c1dd35766ab0f5dd010fb492799916bf The OpenSSF Package Analysis project identified '@rrvis/logger' @ 99.99.2 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11926 Malicious code in tracking-protection-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7e3c4e6767c5b9de18b97979fd15fbe90fdc3b01d78bb3ce044f224e588787a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11925 Malicious code in com.unity.assetgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dee635c5dd8d8b009c47b1924e679ac0f95c83a41bbff41ff4d9978f75dae3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11924 Malicious code in editions-dev-workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e10c5fb118ea2960476ee2fa51f5d3d97e5834b44b3ce58aef95d3fdf1d5a822 The OpenSSF Package Analysis project identified 'editions-dev-workshop' @ 5.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-11923 Malicious code in non-existing-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d6cdc7e109d95350fca4106c87505a6e873352199682c0b1edc6cb36e3ea84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Tibbo AggreGate Network Manager

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve code execution on the affected device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

MAL-2024-11919 Malicious code in yandex-pandora-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7c8829575ea2c09d2db8f6f98a73635e882f6ac8084b06174761270128f3438 The OpenSSF Package Analysis project identified 'yandex-pandora-docs' @ 1.0.0 npm as malicious. It is considered malicious because: - The packag...

The Windows Registry Adventure #5: The regf file format

Posted by Mateusz Jurczyk, Google Project Zero As previously mentioned in the second installment of the blog post series "A brief history of the feature", the binary format used to encode registry hives from Windows NT 3.1 up to the modern Windows 11 is called regf. In a way, it is quite special,...