mvn_pwn

MVN PWN Malicious Maven pom.xml that uses "groovy-maven-plugin" to get RCE Full payload with dependencies can be found at the following blog: https://security.humanativaspa.it/abusing-mavens-pom-xml/...

AnonX

NOTE AnonX script was based on we-transfer public API and has stopped working after three weeks from its release. “All good things must come to an end, so it’s with a heavy heart and through held-back tears that we must announce that we’ll be retiring our Public API. Sad times.” says Stephen. For...

compromised-action

compromised-action Test repo: simulates CVE-2025-30066 style compromised GitHub Action for security research/testing chainradar...

CVE-2021-30481

CVE-2021-30481 CVE details: https://nvd.nist.gov/vuln/detail/CVE-2021-30481 Exploit code depends on SteamworksPy...

mediator

Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a "mediator" server that bridges the connections. This removes the need for the operator/handler to set up port forwarding in order to listen for the connection. Mediator also allows you to create...

CVE-2025-53547-POC

CVE-2025-53547 POC this is a poc for CVE-2025-53547 Chart.lock links test file to /tmp/1.txt /tmp/1.txt inject a command that create /tmp/2.txt In real product enviroment, you can change Chart.lock link file to inject any command you want such as: /root/.bashrc /root/.bashprofile /etc/profile...

jsonorg-fn1

json.org CVE-2022-45688 false negative The project illustrates CVE-2022-45688 in json.org -- there is a simple application XML2JSONConverter to read XML from input, convert it to JSON and pretty-print it to the console. Using malicious input, the application crashes with a stackoverflow. The test...

CVE-2011-1475

CVE-2011-1475 Check dependency vulnerabilities using Maven on CVE-2011-1475 This project is to test Maven with Travis CI...

CVE-2020-15227

CVE-2020-15227 DISCLAIMER! I take no responsibility of using it in wild life environment so please do NOT do it. This thingy is just to demonstrate and for test things for sysadmins This tool tests for vulnerability in nette/application. How to fix the vulnerability Composer Update dependency to...

Dependency Scanning

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

ore-mal-pkg-inspector

OreWatch Multi-Ecosystem Malicious Package Detection and Supply Chain Security Scanner A production-grade security tool for detecting malicious packages and supply chain threats across npm, PyPI, Maven, RubyGems, Go, and Cargo ecosystems. Leverages automated threat intelligence collection from...

mininode

Mininode Mininode is a CLI tool to reduce the attack surface of the Node.js applications by using static analysis of source code. It supports two modes of reduction 1 coarse, 2 fine. Mininode constructs the dependency graph modules and functions used of the application starting from main file, i....

trustlock

trustlock A Git-native dependency admission controller. Evaluates trust signals on every dependency change. How it works trustlock runs as a Git pre-commit hook advisory mode and a CI check enforce mode: Advisory pre-commit: warns on violations, exits 0, advances the trusted baseline when all...

corelight-client

.. corelight-client: .. Version number is filled in automatically. .. |version| replace:: 1.5.22 ==================================== Corelight Sensor Command Line Client .. contents:: Overview This tool provides a command-line client for the Corelight Sensor , aBro appliance engineered from the...

CVE-2021-43616

Repo demonstrating CVE-2021-43616 / https://github.com/npm/cli/issues/2701 Remove the nodemodules folder and run npx npm@8 ci, you can see how npm will install version 2.2.x 2.2.16 at the time of this commit even though package-lock.json requires 2.0.0 cat nodemodules/shortid/package.json I've...

Malicious code in util-foriepft (npm)

[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through childprocess and sends thei...

react2shell

React2Shell Vulnerability Checker CVE-2025-55182 Detection Tool for Ubuntu Linux and Windows 10/11 Description This tool detects potential React2Shell vulnerabilities CVE-2025-55182 in React projects by checking: package.json and lock files for vulnerable packages nodemodules directory for affect...

VulnReach

VulnReach Runtime-aware SCA — proves which CVEs are actually reachable, not just installed. VulnReach is now an officialOWASP Project. 🎉 Demo Step 1 — SCA surfaces 74 CVEs across dependencies Step 2 — VulnReach proves which ones are actually reachable Findings — evidence chain per CVE Dashboard —...

pkgxray

pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...

sloppy-joe

Catch hallucinated, typosquatted, and non-canonical dependencies before they reach production. cargo install sloppy-joe TheLiteLLM supply chain attack March 2026 compromised a package with 97M monthly downloads. Attackers stole publishing credentials, pushed malicious versions that harvested SSH...