PT-2020-21400

Name of the Vulnerable Software and Affected Versions maybemaliciouspackage affected versions not specified Description The issue concerns malicious code within the package that executes a postinstall script, printing the system's SSH keys to the console. There are no further signs of compromise...

PT-2020-21304

Name of the Vulnerable Software and Affected Versions only-test-not-install versions affected versions not specified Description The issue concerns malicious code within the package that deletes the folder /test from the system as a postinstall script. There are no further signs of compromise...

PT-2020-21158

Name of the Vulnerable Software and Affected Versions harmlesspackage version 0.0.1 Description The issue concerns malicious code embedded in the postinstall script of the package. This script prints a message to the console and performs a GET request to a remote server. Recommendations Remove th...

PT-2020-21371

Name of the Vulnerable Software and Affected Versions cage-js versions all Description The issue concerns malicious code in the software that downloads and runs a script from a remote server as a postinstall script. Any computer with this package installed should be considered fully compromised,...

Malicious Package in kraken-api

Version 0.1.8 of kraken-api contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. Recommendation Any computer that has this package installed or running should be considered fully compromised. All...

GHSA-W3F3-4J22-2V3P Malicious Package in destroyer-of-worlds

The package destroyer-of-worlds contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems...

PT-2020-21080

Name of the Vulnerable Software and Affected Versions font-scrubber version 1.2.2 Description The issue concerns malicious code in the postinstall script of the affected software, which attempts to upload sensitive system files to a remote server. These files include configuration files, command...

PT-2020-21537

Name of the Vulnerable Software and Affected Versions destroyer-of-worlds affected versions not specified Description The issue concerns a package that contains malicious code, specifically a bash script run as a postinstall script. This script is designed to delete system files and exhaust syste...

PT-2020-21274

Name of the Vulnerable Software and Affected Versions kraken-api version 0.1.8 Description The issue concerns malicious code in the postinstall script of the affected version, which contacts a Command and Control server to execute arbitrary commands, potentially leading to full compromise of the...

PT-2020-13661 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.19 Description: The issue is related to missing token checks in the com postinstall component, which leads to Cross-Site Request Forgery CSRF. CSRF is an attack where an attacker tricks a user into performing...

Malicious Package

1337qq-js is a vulnerable package. In the postinstall script, the package targets UNIX systems by reading system files, environment variables and npmrc file, and exfiltrates the information to an external server at 119.28.41.206 on port 9999...

Node.js third-party modules: Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package

I would like to report an arbitrary filesystem write vulnerability in Yarn when installing a malicious package from the default repositories. This vulnerability has the potential for RCE -- even if --ignore-scripts is disabled. It allows a malicious package, upon install, to write to any path on...

AZL-44988 CVE-2016-4983 affecting package dovecot 2.3.20-1

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

CVE-2016-4983

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

CVE-2016-4983

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

Code injection

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

CVE-2016-4983

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

CVE-2016-4983

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

CVE-2016-4983

A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files...

Solaris 10 (x86) : 119784-43

Vulnerability in the Solaris component of Oracle Sun Products Suite subcomponent: Bind/Postinstall script for Bind package. The supported version that is affected is 10. Very difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component o...