MAL-2023-8290 Malicious code in poc-nvk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10eb10880328aea55a7c7620d283f145ebcb574bfc98567eef9ad44d1ee8fcdb The OpenSSF Package Analysis project identified 'poc-nvk' @ 0.1.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8573 Malicious code in pyhulul (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f22a13d592f8a4de9eaf39b1c4c0c149232890e90dc5cff2988d49901d31a3e2 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8575 Malicious code in pyioler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b5a0ae31e85484643163bd7b0da8800b531141a1e5d14a97f534b2bfdbefb531 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions

A new deceptive campaign has been observed hijacking GitHub accounts and committing malicious code disguised as Dependabot contributions with an aim to steal passwords from developers. "The malicious code exfiltrates the GitHub project's defined secrets to a malicious C2 server and modify any...

MAL-2023-8568 Malicious code in pyalsogkert (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx db76c02045b01626113fc566fbbcd5f7fd5ccbd230e7e5c6dc0ed090a712c9b1 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8566 Malicious code in kokokoako (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 037e7b78b81b8740ce2627e91bec2d913cb5ef310bf3d7a80046fee57dd42162 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8588 Malicious code in pytasler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9209d9bf3f5a8205e05d9cb3e590cb8ad8cdf90cedb528dd047828c38b308361 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8574 Malicious code in pyioapso (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ddface0422e0d25912e1810f515798f9258e861b2f6d89a9514856d598a5395f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8578 Malicious code in pykokalalz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ea135d81e5fdfe2d80397f1d6a5b8d0003b8c91632b9dd89163b6b5817e3684e Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8572 Malicious code in pyhjdddo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ac1a1233d8897ffaa72bc15d95e9f16517f66801df9f3eee30f97a8dc675d7bf Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8580 Malicious code in pyktrkatoo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a5fdb3eb98d4eda70237ca547bc7f49c932b195449c4c4faa4ffdaf5c78f1908 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8587 Malicious code in pytarlooko (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6dddca319cc76ce2f8951f40c21b31bf4a25775212cc5339063154c7aecf052f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8579 Malicious code in pykooler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 62467741e97dcaabf79c3644575f93878d1abbf8757c6b67610de40e566ccd4f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8585 Malicious code in pystallerer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b5a51d76ce9c25a9173b53083249e289f894f767751f075d7d9bf112d946a7ee Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you...

MAL-2023-8369 Malicious code in telethon2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2f513e1bd0172cda035284efad9368870bc46158926c112ccd7fc881e6af75be Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-8583 Malicious code in pyowler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9df2ac0489cd9816fc13f309f73773ae3fc26794b44dd4930ab92a367115899f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8586 Malicious code in pystob (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f7f671a57787306aed1f0f0baf0c3026c4cb894d7b968ee5648246b4af795570 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in aws-consoler2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b37bd86b6f9bda9d03029c9d2fa09561b2b43cda7c3fddda1389c8e193c4a938 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-8358 Malicious code in aws-consoler2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b37bd86b6f9bda9d03029c9d2fa09561b2b43cda7c3fddda1389c8e193c4a938 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...