packj

Packj 标记恶意/高风险的开源包 Packj （发音为 package）是一款帮助缓解软件供应链攻击的工具。它可以检测来自流行开源包注册中心（如 NPM、RubyGems 和 PyPI）的恶意、存在漏洞、已废弃、拼写错误以及其他“高风险”包。该工具易于定制以降低噪音。Packj 始于一个博士研究项目，目前正在多个政府资助下进行开发。 注意 本月晚些时候将推出自托管 Packj Web 服务器和多项集成 👊 关注此仓库以获取最新信息。 目录 快速开始 - 可作为 Docker 镜像、GitHub Action 和包使用 功能 - 深度静态/动态代码分析与沙箱 支持的生态系统 -...

aura

该仓库已迁移至新地址：https://github.com/SourceCode-AI/aura 安全审计与代码内省 关于问题 当前开发趋势是在开发阶段使用大量软件包，即便它们只提供微不足道的功能，仅由11行代码组成。当我们将其与非常宽松的发布新包策略结合起来时，就会看到针对开发者的恶意攻击呈上升趋势。威胁行为者采用了多种不同的方法： 拼写错误攻击：使用拼写错误的名称，可能因意外安装 诱饵包：使用吸引人的名称，试图引诱开发者安装 劫持现有包：通过 GitHub 提交或其他来源泄露的凭据 这些仅仅是开发者可能自我危害的几种技术示例。而由于 PyPI 或 NPM...

ore-mal-pkg-inspector

OreWatch 多生态恶意包检测与供应链安全扫描器 一款生产级安全工具，用于检测 npm、PyPI、Maven、RubyGems、Go 和 Cargo 生态系统中的恶意包与供应链威胁。利用从可信安全来源自动收集的威胁情报，识别项目中受感染的依赖项。 OreWatch 是产品及 PyPI 包名。当前源代码仓库路径仍使用 ore-mal-pkg-inspector。 视频 安装 https://github.com/rapticore/ore-mal-pkg-inspector/issues/2issue-4215016110 OreWatch 与 Cursor...

depx

depx Inteligencia de paquetes maliciosos & cadena de suministro Características • Instalación • Uso • Ejecutando depx • JSON • Únete a Discord depx es una CLI rápida y pasiva de inteligencia de la cadena de suministro. Te indica si un paquete es publicaciones secuestradas, robadores de...

Supply-Chain

软件供应链安全 一个关于软件供应链安全的综合性三本书系列，涵盖威胁、防御和治理。这份开源手稿为安全专业人士、开发人员和组织领导者提供了保护现代软件开发实践的实际指导。 书籍系列 书籍| 标题| 章节| 重点 ---|---|---|--- 第一本| 理解软件供应链| 1-10| 基础与攻击模式 第二本| 保护软件供应链| 11-22| 实际防御与实施 第三本| 治理软件供应链| 23-33| 政策、合规与组织战略 第一本：理解软件供应链 提供理解供应链安全的基础：现代软件如何构建、威胁格局、历史攻击以及详细的攻击模式。 第一部分 - 基础（第1-4章）...

msidump

msidump MSI Dump - una herramienta que analiza paquetes de instalación MSI maliciosos, extrae archivos, flujos, datos binarios e incorpora un escáner YARA. En documentos de Office con macros, podemos usar rápidamente oletools mraptor para determinar si un documento es malicioso. Si queremos...

cisco_asa_research

Investigación sobre Cisco ASA Este repositorio contiene diapositivas y código presentados en Black Hat USA 2022 y DEF CON 30. Se puede encontrar lo siguiente: Diapositivas Presentaciones de DEF CON 30 y Black Hat. La presentación de DEF CON es ligeramente más larga debido a un espacio de tiempo m...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package...