aws-key-disabler

AWS Lambda - IAM Access Key Disabler The AWS Key disabler is a Lambda Function that disables AWS IAM User Access Keys after a set amount of time in order to reduce the risk associated with old access keys. AWS Lambda Architecture SysOps Output for EndUser Developer Toolchain Current Limitations A...

GiveMeSecrets

GiveMeSecrets 使用正则表达式从指定仓库（GitHub、pip 或 npm）中获取敏感信息。 依赖项 运行此脚本只需安装 Python 3.6 或更高版本。此外，系统中还必须安装 git、pip 和 npm。 使用方法 使用非常简单，只需运行脚本并传递选项（1 - GitHub；2 - pip；3 - npm）以及仓库地址。示例： root@kitploit: python3 givemesecrets.py --option 1 --repo https://github.com/Josue87/BoomER.git 西班牙语文章在 Boomernix.com 作者 Jos...

CVE-2026-29786

CVE-2026-29786 研究： Joshua van Rijswijk 描述 本仓库包含 CVE-2026-29786 的 概念验证（PoC） ，这是 tar npm 包中的一个漏洞，允许特制的归档文件创建指向预期解压目录之外的硬链接 。 当 tar 归档文件包含驱动器相对链接目标 （如 C:../target.txt）时，就会出现此问题。由于库在解压过程中执行验证和路径规范化的顺序问题，遍历保护可以被绕过。 规范化后，路径变为 ../target.txt，从而允许链接目标逃逸出配置的解压目录。 当写入解压后的文件时，外部文件会被修改，因为两个路径引用的是同一个硬链接。 漏洞详情...

deephas-1.0.7-Prototype-Pollution-PoC-CVE-2026-25047-

deephas = 1.0.8 中修复。 参考链接： GitHub 安全公告（GHSA-2733-6c58-pf27） NVD CVE-2026-25047 原始仓库：sharpred/deepHas 环境要求 Python 3.x Node.js（推荐 16 / 18 / 20） 使用 npm 安装存在漏洞的包 安装与使用 1. 克隆本仓库： root@kitploit: git clone https://github.com/your-username/deephas-poc-cve-2026-25047.git cd deephas-poc-cve-2026-25047...

CVE-2020-17453

バッジ ライセンス MIT インストール npm で CVE-2020-17453 をインストール root@kitploit: npm install cve-2020-17453 -g 使い方 単一URLの例 root@kitploit: CVE-2020-17453 -u http://example.com 使い方 URLリストの例 root@kitploit: CVE-2020-17453 -l urls.txt -o out.txt...

js-x-ray

!slsa...

dcipher-cli

dcipher-cli ハッシュをオンラインのレインボーテーブルおよびルックアップテーブル攻撃サービスを使用して、ターミナルから直接クラックします。 インストール root@kitploit: ❯❯❯ npm install -g dcipher-cli 使用方法 root@kitploit: ❯❯❯ dcipher --help ハッシュをオンラインのレインボーテーブルおよびルックアップテーブル攻撃サービスを使用して、ターミナルから直接クラックします。 使い方 ❯❯❯ dcipher ❯❯❯ echo | dcipher オプション -p, --plain ログ記号なしで出力を表示 例...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

CVE-2023-37478_npm_vs_pnpm

pnpm vs npm exploit This repo showcases how a difference in npm and pnpminstallation from tarballs can be exploited. The exploit is recorded in CVE-2023-37478. The javascript package constructed here claims it prints out a nice message to the user. When installed with npm, this is true. However,...

warcannon

WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...

ROOT-APP-NPM-CVE-2022-21680 CVE-2022-21680 in marked - Patched by Root

Root has patched CVE-2022-21680 in the marked package for Root:npm. Multiple fixed versions available...

CVE-2021-26700

CVE-2021-26700 （注意：本手册仅适用于DSNS实验室成员。） Intruduction 这是一个远程代码执行（RCE）漏洞，存在于Visual Studio Code（VS Code）的一个名为npm的扩展中，该扩展由微软开发，旨在支持运行package.json文件中定义的npm脚本。 为了利用此漏洞，攻击者可以将其公共GitHub仓库中的文件隐藏一些恶意脚本，并对npm扩展使用的配置进行微小调整。如果有人下载此仓库并在已安装指定扩展的VS...

ROOT-APP-NPM-CVE-2022-37603 CVE-2022-37603 in loader-utils - Patched by Root

Root has patched CVE-2022-37603 in the loader-utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-37599 CVE-2022-37599 in loader-utils - Patched by Root

Root has patched CVE-2022-37599 in the loader-utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-32141 CVE-2026-32141 in flatted - Patched by Root

Root has patched CVE-2026-32141 in the flatted package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-VJH7-7G9H-FJFH GHSA-vjh7-7g9h-fjfh in elliptic - Patched by Root

Root has patched GHSA-vjh7-7g9h-fjfh in the elliptic package for Root:npm. Multiple fixed versions available...