cve-lite-on-pi

cve-lite-on-pi 在 pi 单体仓库上运行 CVE Lite CLI 的简短报告及其发现。 背景 本实验的灵感来自文章 "OWASP CVE Lite CLI – 用于扫描项目中漏洞的新工具" （CyberSecurityNews）。 什么是 CVE Lite CLI？ CVE Lite CLI 是一个面向开发者的、本地 的命令行扫描器，适用于 JavaScript/TypeScript 项目。它无需安装或运行你的依赖项，而是读取你的锁文件 （package-lock.json、pnpm-lock.yaml、yarn.lock 或...

VulnCheck KEV: CVE-2023-45311

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project that depends on fsevents distributes code that was obtained from that URL at a time when it was controlled by an...

Other Attempts to Take Over Open Source Projects

After the XZ Utils discovery, people have been examining other open-source projects. Surprising no one, the incident is not unique: The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated...

OpenSSF Warns of Fake Maintainers Targeting JavaScript Projects

By Deeba Ahmed Alarming social engineering attacks target critical open-source projects! Learn how to protect your project and the open-source community from takeovers. This is a post from HackRead.com Read the original post: OpenSSF Warns of Fake Maintainers Targeting JavaScript Projects...

CVE-2023-45311

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project that depends on fsevents distributes code that was obtained from that URL at a time when it was controlled by an...