secretive

Secretive Secretive 是一款使用安全隔区（Secure Enclave）来保护和管理 SSH 密钥的应用。 为什么？ 更安全的存储 SSH 密钥最常见的存放方式就是直接放在磁盘上，靠正确的权限来保护。在大多数情况下这没有问题，但恶意用户或恶意软件要复制你的私钥并不困难。如果你的密钥由安全隔区保护，那么按设计它们就无法被导出。 访问控制 如果你的 Mac 拥有安全隔区，它也就支持 Touch ID 或 Apple Watch 认证等强访问控制。你可以在访问密钥之前要求必须完成 Touch ID（或 Apple Watch）认证。 通知 只要你的密钥被访问，Secretiv...

CVE-2023-34039

CVE-2023-34039 CVE-2023-34039 的 POC：VMWare Aria Operations for Networks vRealize Network Insight 静态SSH密钥远程代码执行 技术分析 漏洞的根本原因分析可在我的博客中找到： https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ 总结 VMWare Aria Operations for Networks vRealize Network Insight 从6.0到6.10版本没有为...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

CVE-2020-12116

CVE-2020-12116 概念実証コード：CVE-2020-12116を悪用した、ManageEngine OpMangerに対する認証なしの任意ファイル読み取り。 概要...

trommel

TROMMEL TROMMELは、組み込みデバイスのファイルをふるいにかけ、潜在的な脆弱性の指標を特定します。 TROMMELは以下の指標を特定します： Secure Shell SSH キーファイル Secure Socket Layer SSL キーファイル Internet Protocol IP アドレス Uniform Resource Locator URL メールアドレス シェルスクリプト Webサーバーバイナリ 設定ファイル データベースファイル 特定のバイナリファイル（例：Dropbear、BusyBoxなど） 共有オブジェクトライブラリファイル...

CVE-2026-73678

CVE-2026-73678 enables unauthenticated remote code execution in MindsDB Minds Platform

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

MAL-2026-13775 Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

MAL-2026-13628 Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

MAL-2026-13519 Malicious code in streak-kit-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

MAL-2026-11520 Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

SUSE CVE-2026-52811

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Repository.UploadRepoFiles checks for symlinks only on the leaf of the upload target osx.IsSymlinktargetPath. The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component -...