PolinRider

PolinRider: DPRKの脅威アクターが数百のGitHubリポジトリにマルウェアを埋め込む 日付: 2026-03-07 最終更新: 2026-04-11 — 以下の4月10日～11日の更新を参照 深刻度: CRITICAL — 1,950以上 の公開リポジトリにわたる活発なサプライチェーン感染、TasksJacker / Contagious Interviewクラスターとの運用統合を確認...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

git-all-secrets

git-all-secrets 概要 git-all-secrets は以下のことが可能なツールです： 組織の複数の公開/非公開 GitHub リポジトリをクローンし、スキャンする、 組織に所属するユーザーの複数の公開/非公開 GitHub リポジトリをクローンし、スキャンする、 組織の単一の公開/非公開リポジトリをクローンし、スキャンする、 ユーザーの単一の公開/非公開リポジトリをクローンし、スキャンする、 ユーザーの単一の公開/シークレット gist をクローンし、スキャンする、 組織内のチームのリポジトリをクローンし、スキャンする、 上記すべてを同時に行う！ そうです！...

Vulnhalla

Vulnhalla LLM分類による自動CodeQL分析 詳細な研究背景やVulnhallaの動機については、公式CyberArk脅威研究ブログ記事をご覧ください： Vulnhalla: Picking the True Vulnerabilities from the CodeQL Haystack Vulnhallaはセキュリティ分析パイプライン全体を自動化します： 1. リポジトリの取得 ：特定のプログラミング言語のGitHubリポジトリを取得 2. CodeQLデータベースのダウンロード ：利用可能な場合、対応するCodeQLデータベースをダウンロード 3. CodeQLクエリの...

CVE-2020-1472

CVE-2020-1472 CVE-2020-1472 エクスプロイトソース: https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

gitrob

Gitrob: OSINTにおけるオープンソースの活用 Gitrobは、Githubの公開リポジトリにプッシュされた潜在的に機密性の高いファイルを見つけるためのツールです。Gitrobは、ユーザーまたは組織に属するリポジトリを設定可能な深さまでクローンし、コミット履歴を反復処理して、潜在的に機密性の高いファイルのシグネチャに一致するファイルにフラグを立てます。結果はWebインターフェースを通じて表示され、簡単に閲覧・分析できます。 使い方 gitrob options target target2 ... targetN オプション -bind-address string Addres...

PoC_CVEs

PoC CVEs — 概念実証リポジトリインデックス GitHub上の公開されている概念実証リポジトリをCVE識別子にマッピングした、継続的に更新されるインデックスです。教育目的および防御的なセキュリティ研究のために厳密に使用されます。 ライブ検索インターフェース labs.jamessawyer.co.uk/cves/ 検索可能なWebインターフェース — フルインデックスを検索し、CVE IDまたはリポジトリの断片で数秒でPoCリポジトリを見つけられます。 これは何か...

CVE-2026-56443

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-Poc_All_in_One

CVE Poc All in One 🛡️ This is a tool for searching, filtering...

Malicious code in @deliveroo/determinator (npm)

npm/@deliveroo/determinator is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @workbench-stack/core (npm)

npm/@workbench-stack/core is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @nebula.js/sn-layout-container (npm)

npm/@nebula.js/sn-layout-container is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/sprout-icons (npm)

npm/@qlik/sprout-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11984 Malicious code in qlik-object-conversion (npm)

npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in qlik-object-conversion (npm)

npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @nebula.js/sn-listbox (npm)

npm/@nebula.js/sn-listbox is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in qlik-chart-modules (npm)

npm/qlik-chart-modules is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11806 Malicious code in @qlik/sprout-gesture (npm)

npm/@qlik/sprout-gesture is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

MAL-2026-11625 Malicious code in @onereach/regular-expressions-test (npm)

npm/@onereach/regular-expressions-test is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

Malicious code in @nebula.js/sn-nav-menu (npm)

npm/@nebula.js/sn-nav-menu is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...