MAL-2023-1371 Malicious code in install-pytest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c354c0f5dc76b96d0db0745a885c308a97e8edfa82d219fda8c353dd567b43d6 The OpenSSF Package Analysis project identified 'install-pytest' @ 1.12.7 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1366 Malicious code in guiconsoles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24a3798623a3f68e4c418540b53aa81d86785aeb5618a02914aa14be4c4311ba The OpenSSF Package Analysis project identified 'guiconsoles' @ 1.0.5 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1160 Malicious code in docs-component-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e4e933240e0533957a39c9132a6925469e069081320949dc198545fd1080a49 The OpenSSF Package Analysis project identified 'docs-component-title' @ 1.2.2 npm as malicious. It is considered malicious because: - The packa...

MAL-2023-1157 Malicious code in docs-component-folder-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 029903e7351485fc54de0e50d6f2f3c9c822895bd8d97930476b5a69f23dd6f9 The OpenSSF Package Analysis project identified 'docs-component-folder-selector' @ 1.0.6 npm as malicious. It is considered malicious because: -...

MAL-2023-575 Malicious code in maddy_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx edb288f616afccdf20ab32d24f5f0616b0b2b91bcdb3d8f0d8bd60e1adbe6b0a Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-167 Malicious code in cfa-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5562a6cb1d5f239216be52c28e8d316e8ffe0f490d11978863202a6fcfcbe8bc Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-1204 Malicious code in hyrule-react-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3b82bec5139c178e3b425e5e458a9c7b248b17db5192cf6178702cbb26822dba The OpenSSF Package Analysis project identified 'hyrule-react-commons' @ 2.0.1 npm as malicious. It is considered malicious because: - The packa...

ddev (>=1.4.1, <=2.1.0), hoppr (>=1.7.0, <=1.13.2) +2 more potentially affected by unknown CVE via in-toto (>=1.0.1, <=1.4.0)

in-toto PYPI version =1.0.1, =1.4.1, =1.7.0, =1.0.18, =1.4.9 - hoppr-openssf-scorecard 0.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-JJGP-WHRP-GQ8M...

ddev (>=1.4.1, <=2.1.0), hoppr (>=1.7.0, <=1.13.2) +2 more potentially affected by unknown CVE via in-toto (>=1.0.1, <=1.4.0)

in-toto PYPI version =1.0.1, =1.4.1, =1.7.0, =1.0.18, =1.4.9 - hoppr-openssf-scorecard 0.0.1 Source cves: unknown CVE Source advisory: GHSA-JJGP-WHRP-GQ8M...

ddev (>=1.4.1, <=2.1.0), hoppr (>=1.7.0, <=1.13.2) +2 more potentially affected by CVE-2023-32076 via in-toto (>=1.0.1, <=1.4.0)

in-toto PYPI version =1.0.1, =1.4.1, =1.7.0, =1.0.18, =1.4.9 - hoppr-openssf-scorecard 0.0.1 Source cves: CVE-2023-32076 Source advisory: GHSA-WC64-C5RV-32PF...

hoppr (>=1.7.0, <=1.13.2), hoppr-cop (>=1.0.18, <=1.4.9) +1 more potentially affected by CVE-2023-32076 via in-toto (1.4.0)

in-toto PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on in-toto and may be impacted: - hoppr =1.7.0, =1.0.18, =1.4.9 - hoppr-openssf-scorecard 0.0.1 Source cves: CVE-2023-32076 Source advisory: OSV:GHSA-WC64-C5RV-32PF...

MAL-2023-1190 Malicious code in gql2ts-from-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a1acee750c796d45e602f027ea638a05590a78bb142aca903bfb2bb169466a6 The OpenSSF Package Analysis project identified 'gql2ts-from-schema' @ 2.1.1 npm as malicious. It is considered malicious because: - The package...

hoppr (>=1.7.0, <=1.13.2), hoppr-cop (>=1.0.18, <=1.4.9) +1 more potentially affected by CVE-2023-32076 via in-toto (1.4.0)

in-toto PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on in-toto and may be impacted: - hoppr =1.7.0, =1.0.18, =1.4.9 - hoppr-openssf-scorecard 0.0.1 Source cves: CVE-2023-32076 Source advisory: OSV:PYSEC-2023-63...

ddev (>=1.4.1, <=2.1.0), hoppr (>=1.7.0, <=1.13.2) +2 more potentially affected by CVE-2023-32076 via in-toto (>=1.0.1, <=1.4.0)

in-toto PYPI version =1.0.1, =1.4.1, =1.7.0, =1.0.18, =1.4.9 - hoppr-openssf-scorecard 0.0.1 Source cves: CVE-2023-32076 Source advisory: MEND:CVE-2023-32076...

MAL-2023-1410 Malicious code in spammingsynonym (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 97a0609c600ca9bc940340f2595fb41607b5af5c3931f10350bea6aa3c9879ae The OpenSSF Package Analysis project identified 'spammingsynonym' @ 3.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1409 Malicious code in smsobfuscate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa2efc28ecdebc90e41edd50503e199984f68d05cb13edab8b6e8d503d18e75c The OpenSSF Package Analysis project identified 'smsobfuscate' @ 1.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1369 Malicious code in iiris-new2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0f584cfefbd98e630ed7a59b892d50d96387e5941f2a09a3543324b1c418396 The OpenSSF Package Analysis project identified 'iiris-new2' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1419 Malicious code in test-test-test-leys-check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a0f1b447a06ae8cd034c08db769374bbc319460cc98a553bfc472d87ca1ef6cc The OpenSSF Package Analysis project identified 'test-test-test-leys-check' @ 9.9.9 pypi as malicious. It is considered malicious because: - The...

MAL-2023-1292 Malicious code in seafoam-desktop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11b7b515412cb320d382cffb4a3abe4fa232556d7db6ac3dde904bd295b279a3 The OpenSSF Package Analysis project identified 'seafoam-desktop' @ 10.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1311 Malicious code in suncorp-styleguide-react-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b6a39ac171632a984b8ac8c3e53ab935e47753ac7e0df7161daa7bc23f8e08d The OpenSSF Package Analysis project identified 'suncorp-styleguide-react-components' @ 102.0.0 npm as malicious. It is considered malicious...