Malicious code in black-spindle (npm)

Source: ossf-package-analysis c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab The OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...

All-In-One: A Composable Attack on LLM Transformations

Quantization, pruning, and model merging are popular transformations applied to deployment-ready LLMs to improve efficiency and downstream performance. Recent work has shown that these transformations can introduce a security threat: an adversary can train a model that passes safety checks in its...

Malicious code in @flexmr/utils (npm)

Source: ossf-package-analysis fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4 The OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in @flexmr/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52 @flexmr/[email protected] ships a one-line re-export stub whose package.json declares its sole dependency daemon-thread-lookup-buffer via a direct HTTPS U...

Runaway Reaction: When Benign Skills Compose into Malicious Behavior

Agent skills package task-specific knowledge and procedures that can be composed to support complex agent tasks, while public marketplaces provide a growing pool of reusable skills. Existing security vetting, however, largely evaluates skills in isolation, leaving composition-induced risks...

Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

Malicious code in wurl_show_data (RubyGems)

Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The package executes one or more commands associated with maliciou...

Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

Source: ossf-package-analysis 278821d7a9d245a4193d8536c0b127f61cf1b13335dfe91abaefece6b908a57e The OpenSSF Package Analysis project identified '@asdfaskdjfksadhfkasf/nadaver2' @ 102.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in lc-config (npm)

Source: ossf-package-analysis d918d66169ac2696569bb389d82b0b95640986fdc77ab8cec9639908d156d0c5 The OpenSSF Package Analysis project identified 'lc-config' @ 5.5.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - T...

Malicious code in kubernetes.io (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 00f207ddd7d4909824d1a01b502b9d29b27380e31b9b410162ed5381de2fae41 The OpenSSF Package Analysis project identified 'kubernetes.io' @ 1.0.0 npm as malicious. It is considered malicious because: -...

Malicious code in kobi--front-helpers (npm)

Source: ossf-package-analysis 5177d79e84b460a9e6e01e3f7ec740846cab3ff8094ccf7fa38232683498d45c The OpenSSF Package Analysis project identified 'kobi--front-helpers' @ 1.15.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in kkrfunds (npm)

Source: ossf-package-analysis 74bb5d7b33431c1009ea3297276e5033a7a4b29132c38f97d0a2ed19a5bf6061 The OpenSSF Package Analysis project identified 'kkrfunds' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...

Malicious code in keycloak-server (npm)

Source: ossf-package-analysis 3df989aa26dccceca3917c9b3454427df4f54e9c104fbc080e913d30af3e66b2 The OpenSSF Package Analysis project identified 'keycloak-server' @ 0.0.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in k0m3g4-test (npm)

Source: ossf-package-analysis bd260efc78494efc57d67f6576d7ae30b8e58e866ee7a3c228692548174c1e19 The OpenSSF Package Analysis project identified 'k0m3g4-test' @ 2.999.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in justeat-storybook (npm)

Source: ossf-package-analysis 577d8ffd11e5da3a5000b8a390c45c8474d2dd362e509a65a107f2b0df13e563 The OpenSSF Package Analysis project identified 'justeat-storybook' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in jsondatatoruby (npm)

Source: amazon-inspector 89f78392e9a3a510c3e509f058c49aff59b8b98fff6beca0f5f30bbb8e85a9bd The package jsondatatoruby was found to contain malicious code. Source: ossf-package-analysis baeae2c02ab89a72cdfb758215138d1c6ec321ee3c17535b0f2cbe54a341784d The OpenSSF Package Analysis project identified...

Malicious code in bender-rspack-config (npm)

Source: ossf-package-analysis 159730c04aeb50c0e832685be81c3f332d8692bf4a9f1a419c7223dbe5059491 The OpenSSF Package Analysis project identified 'bender-rspack-config' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in n8n-nodes-sysdiag2 (npm)

Source: ossf-package-analysis b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990 The OpenSSF Package Analysis project identified 'n8n-nodes-sysdiag2' @ 2.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in jerry1319 (npm)

Source: ossf-package-analysis 39c3e74d9394364350aac9f2396311212f3cf3e8704fb23daf2bca46a9e24227 The OpenSSF Package Analysis project identified 'jerry1319' @ 1.0.10 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior...