Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

DepFuzzer

DepFuzzer DepFuzzer is a tool used to find dependency confusion or project where owner's email can be takeover. Install the tool /!\ This tool requires python = 3.10 /!\ $ python3 -m venv .venv $ source .venv/bin/activate $ pip3 install -r requirements.txt Or you can use the docker image : $ dock...

linux-root-kit

About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...

Malicious code in @flexmr/survey-client (npm)

Source: amazon-inspector ed5d0e26b18d32568569b828bdbe2ccb40d0c4a54780c6e51be6280cb5fc851f @flexmr/[email protected] declares its sole dependency 'marker-index-symbol-schema' as a bare HTTPS URL to https://artifacts.creditslib.com/npm/marker-index-symbol-schema instead of a registry version...

Malicious code in @flexmr/survey-conversation (npm)

Source: amazon-inspector 20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374 package.json declares its sole dependency cache-format-syntax-tracer as a bare HTTPS URL https://artifacts.creditslib.com/npm/cache-format-syntax-tracer rather than a registry version range. On npm install,...

MAL-2026-17899 Malicious code in @flexmr/survey-conversation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374 package.json declares its sole dependency cache-format-syntax-tracer as a bare HTTPS URL...

MAL-2026-17898 Malicious code in @flexmr/survey-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed5d0e26b18d32568569b828bdbe2ccb40d0c4a54780c6e51be6280cb5fc851f @flexmr/[email protected] declares its sole dependency 'marker-index-symbol-schema' as a bare HTTPS URL to...

Malicious code in util-foriepft (npm)

[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through childprocess and sends thei...

Malicious code in @user-interface-common/common-styles (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

Malicious code in @mntv-analysis/ui-components (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

Malicious code in @newspage/lib-ng-async-routes-ui (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In version 99.99.4, index.js sen...

Malicious code in @newspage/libx-amount (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In versions 99.99.4 and 99.99.41...

Malicious code in @mntv-analysis/workspaces-components (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...

Malicious code in @mntv-analysis/ui (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 99.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

MAL-2026-17888 Malicious code in @flexmr/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52 @flexmr/[email protected] ships a one-line re-export stub whose package.json declares its sole dependency daemon-thread-lookup-buffer via a direct HTTPS U...

Malicious code in @user-interface-common/common-styles (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

Malicious code in @mntv-analysis/workspaces-components (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...

MAL-2026-17873 Malicious code in @newspage/libx-amount (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In versions 99.99.4 and 99.99.41...