aura

This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...

ore-mal-pkg-inspector

OreWatch बहु-पारिस्थितिकी तंत्र दुर्भावनापूर्ण पैकेज का पता लगाना और आपूर्ति श्रृंखला सुरक्षा स्कैनर एक उत्पादन-ग्रेड सुरक्षा उपकरण जो npm, PyPI, Maven, RubyGems, Go और Cargo पारिस्थितिकी तंत्रों में दुर्भावनापूर्ण पैकेजों और आपूर्ति श्रृंखला खतरों का पता लगाता है। यह आपके प्रोजेक्ट्स में समझौता ...

depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

packj

Packj दुर्भावनापूर्ण/जोखिमपूर्ण ओपन-सोर्स पैकेजों को चिह्नित करता है Packj उच्चारित 'पैकेज' एक उपकरण है जो सॉफ़्टवेयर आपूर्ति श्रृंखला हमलों को कम करने में मदद करता है। यह लोकप्रिय ओपन-सोर्स पैकेज रजिस्ट्रियों जैसे NPM, RubyGems और PyPI से दुर्भावनापूर्ण, कमजोर, परित्यक्त, टाइपो-स्क्वाटिंग और अन्...

msidump

msidump MSI Dump - एक उपकरण जो दुर्भावनापूर्ण MSI इंस्टॉलेशन पैकेजों का विश्लेषण करता है, फ़ाइलें, स्ट्रीम, बाइनरी डेटा निकालता है और इसमें YARA स्कैनर शामिल है। मैक्रो-सक्षम Office दस्तावेज़ों पर हम तुरंत oletools mraptor का उपयोग करके यह निर्धारित कर सकते हैं कि दस्तावेज़ दुर्भावनापूर्ण है या...

cisco_asa_research

أبحاث Cisco ASA يحتوي هذا المستودع على الشرائح والكود المعروض في Black Hat USA 2022 و DEF CON 30. يمكن العثور على ما يلي: شرائح حزم شرائح DEF CON 30 و Black Hat. حزمة DEF CON أطول قليلاً نظرًا لطول الفترة الزمنية المخصصة. theway - أداة لإنشاء حزم ASDM خبيثة/قابلة للتوزيع لـ Cisco ASA...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package...