1331 matches found
Malicious code in another-depconf-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6876487b755ba50effc916826fdb407f0f653893569fef933deb61a21a8d6626 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in dep-confusion-tester (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a02b1736028edc558aec7dae01fc23a8b183b0eb84ec65f6d97cad92f85d2083 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11964 Malicious code in dep-confusion-tester (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a02b1736028edc558aec7dae01fc23a8b183b0eb84ec65f6d97cad92f85d2083 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in dep-confusion-tester
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in normal-dep
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
@eas-framework/server (>=1.0.1, <=1.5.8), express-nova-login (1.0.0) +2 more potentially affected by CVE-2024-53441 via cookie-encrypter (1.0.1)
cookie-encrypter NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cookie-encrypter and may be impacted: - @eas-framework/server =1.0.1, =1.0.0, =1.6.3, =1.6.4 Source cves: CVE-2024-53441 Source advisory: GHSA-H63V-HW6G-X8HP...
MAL-2024-11225 Malicious code in normal-dep (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f2efb34b8082c086da6493f93ca16d2de070a218ff6cb8f2c32468ca268412f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in normal-dep (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f2efb34b8082c086da6493f93ca16d2de070a218ff6cb8f2c32468ca268412f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in file-dep-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 167e76bf6af632f8aff7b06b0a8b05d6a25772b2cb139605e13b5b9a84ecf53b The OpenSSF Package Analysis project identified 'file-dep-a' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...
MAL-2024-11224 Malicious code in file-dep-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 167e76bf6af632f8aff7b06b0a8b05d6a25772b2cb139605e13b5b9a84ecf53b The OpenSSF Package Analysis project identified 'file-dep-a' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in dep-validator-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af93a927101a23e38ce34664c1c85dc8651f0e3a5a066ec9a110caabe4cadcbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10960 Malicious code in dep-validator-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af93a927101a23e38ce34664c1c85dc8651f0e3a5a066ec9a110caabe4cadcbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in dep-validator-cli
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CycloneDX cdxgen may execute code contained within build-related files
CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...
GHSA-HXF3-VGPM-FV9P CycloneDX cdxgen may execute code contained within build-related files
CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...
CVE-2024-50611
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...
CVE-2024-50611
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...
CVE-2024-50611: Improper Control of Generation of Code
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...