OESA-2023-1403 tang security update

This package is a server for binding data to network presence. First, the client gets a list of the Tang server's advertised asymmetric keys. This can happen online by a simple HTTP GET. Alternatively, since the keys are asymmetric, the public key list can be distributed out of band. Second, the...

GHSA-9VRM-V9XV-X3XR HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service KMS defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the...

HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service KMS defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the...

MAL-2023-644 Malicious code in number_of_input_data_dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ceafccfb70c0ec9fad4c4a8cb8bf240c997458411f9e824f9f7e88ff4918136f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-314 Malicious code in eth-api-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ae0229b0b9b6f52ad99cbadf592c4cd4a35c6b90764717a8d37ce843df055398 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Secrets, Secrets Are No Fun. Secrets, Secrets (Stored in Plain Text Files) Hurt Someone

Secrets are meant to be hidden or, at the very least, only known to a specific and limited set of individuals or systems. Otherwise, they aren't really secrets. In personal life, a secret revealed can damage relationships, lead to social stigma, or, at the very least, be embarrassing. In a...

MAL-2023-824 Malicious code in sword123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6873abc1d5ac185b0cd7f13b940e3144dd46f0fddd5608e317c041de653e8bde Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-307 Malicious code in env-cross (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dfac7391de71e5fbbea3c5880d76d0fada380dc4026cd39541ac9684098b56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-749 Malicious code in rqzax-database (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a84c5b52ec28f42cffc2ec18e27f39dc1c908add4471e1ae31eeea8e752e07e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in velor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8dd8323c45be30eda6a4167c8e3799e4d598711e2568b55238dfea09e727326 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-967 Malicious code in wix-commerce-ticketing-nextjs-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0b99bb56f643f4526ad69d487c48bec96603f7a221baf7ed0637b6cdb74d3c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-164 Malicious code in catteleya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9c8f112541c7f415a060c136109b57be2b983aeab2087f5ac85e0b553baec75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meetingsdk-sample-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b35b4caef11623ed6a19de27a6ca20f776482dc18bfe6fb11b3d852adb69eed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-587 Malicious code in meetingsdk-sample-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b35b4caef11623ed6a19de27a6ca20f776482dc18bfe6fb11b3d852adb69eed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in next-with-frontegg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 251ac37afbe61350facc80a00faa97821168ad425857f580f6fa33910fbd78eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-525 Malicious code in ing-feat-lu-luxtrust-oaw-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0429c78b1da16f9685e08f78ad467a0be68e7b2496e9693f6a25aafaf9057e66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-33 Malicious code in @calizahq/react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 736249350ff22b093bcff8631c4b2722b245bb27b2ef003fdf490a7171dc3c77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-738 Malicious code in reactsix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec975631b56273be6043ff2cb0bf177e4ec19afae757e0dbf9109ca9120cf4c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-589 Malicious code in mesos-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ca86e4f7655ee05071ef73a17f239df8dcc483b932ef71d351cf47e8435376b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in criteo-static-variables-datasource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65ae832c9a084b0c39c57bf3bb68ff1877e5f1370b9c29e564368e0a2d224d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...