depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

packj

Packj señala paquetes de código abierto maliciosos/riesgosos Packj pronunciado 'paquete' es una herramienta para ayudar a mitigar los ataques a la cadena de suministro de software. Puede detectar paquetes maliciosos, vulnerables, abandonados, de typo-squatting y otros 'riesgosos' de registros de...

ore-mal-pkg-inspector

OreWatch Detección de Paquetes Maliciosos Multi-Ecosistema y Escáner de Seguridad en la Cadena de Suministro Una herramienta de seguridad de grado de producción para detectar paquetes maliciosos y amenazas en la cadena de suministro en los ecosistemas npm, PyPI, Maven, RubyGems, Go y Cargo...

msidump

msidump MSI Dump - una herramienta que analiza paquetes de instalación MSI maliciosos, extrae archivos, flujos, datos binarios e incorpora un escáner YARA. En documentos de Office con macros, podemos usar rápidamente oletools mraptor para determinar si un documento es malicioso. Si queremos...

cisco_asa_research

Cisco ASA Research This repository contains slides and code presented at Black Hat USA 2022 and DEF CON 30. The following can be found: Slides DEF CON 30 and Black Hat slide decks. The DEF CON deck is slightly longer due to a longer time slot. theway - a tool for creating malicious/distributable...

Supply-Chain

Seguridad en la Cadena de Suministro de Software Una serie completa de tres libros sobre seguridad en la cadena de suministro de software, que cubre amenazas, defensas y gobernanza. Este manuscrito de código abierto proporciona a profesionales de seguridad, desarrolladores y líderes...

aura

Este repositorio se ha trasladado a una nueva ubicación: https://github.com/SourceCode-AI/aura Seguridad en auditoría e introspección de código Sobre el problema La tendencia actual en el desarrollo es utilizar muchos paquetes en la fase de desarrollo, incluso si proporcionan solo una funcionalid...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

CVE-2026-11386 ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

EUVD-2026-44911

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

CVE-2026-46421 Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...