Design/Logic Flaw

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

Malicious PyTorch dependency 'torchtriton' on PyPI: everything you need to know

The developers of PyTorch a popular machine-learning framework recently identified a malicious dependency confusion attack on the open-source project. Security teams are advised to check for infected resources and rotate any exposed keys...

MAL-2022-4887 Malicious code in node-kexec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c935f2cf93a69d3611bc002c76fb751088ccfda5985581797976d42dc55ce94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5328 Malicious code in phup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dac74638b6d2daf3c5fba99cb693badc947e824ec0622ec155ad7f1a0ee3100 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sponsor-jobs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ff91cd8369dec7dda50c1d1b495256642f2f035c7789c5f99a6520094deabc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in seaport-gossip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcea3993c918d92835f94dd8679cc99510db8b2eddbdd18ab217a46eb283ba86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1565 Malicious code in big-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c644e7d9d5b08b109d7457ceb490ea4a1171713706689d3b66a9a2114f478d4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in prova-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 938fc5bb5c8e1be3541bd49183cc6bed9f7683b7d3d547f7273b89117e79d193 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5823 Malicious code in rmgjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13b895694dae89110a5e80c7137a8ccf64017169fe486b836eb5157c7b3f5ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1478 Malicious code in bcashjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43f17b42835fc6b1885e7f354fcfc94bbb64f66f97e8b1ed5cb2940a07b54051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5494 Malicious code in prova-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 938fc5bb5c8e1be3541bd49183cc6bed9f7683b7d3d547f7273b89117e79d193 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6842 Malicious code in usaa-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8bd018cad308248e0e3f6eaf2d4bea81bc14abf697bcfce887da8bbc923a98b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1813 Malicious code in caliper-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 210ebc0158f74756155a2314326207438ca0b98fbc9a111e29537aee81fe768a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in setup-gamma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deba7e063fe3b4609326e55cea28db816c7049297f8cef8b23d8c2d7589f69f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6450 Malicious code in teleterm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42f34af57c7c8ae4664015ace23dd33fc3e1f96af2443c9f5a37f7a829657d52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yf_hello_world (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e7d00e59d8e35322a71178ba2e7d8ad7b245515fee015d99f8d7c4ec5a7d354 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6519 Malicious code in testherejson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47c63f695aeb904f6eab5e51afade94f1521960e41be223b65673ae0920df981 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5996 Malicious code in securityrele (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 185b542d66b1e73e39974ac16964546da7a68898526013750a29430a2454aab7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5533 Malicious code in pv_ho3ein (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7aa33fb89a5d7bd38f7efcced8a18b26c18b81d9e112bfd15547d569cee8f2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...