35 matches found
CVE-2026-55675
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
CVE-2026-55675
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
EUVD-2026-98742
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
CVE-2026-55675
The Salty documentation repository contains a vulnerability where a fork pull request can execute arbitrary code in a privileged base-repository workflow. Specifically, the .github/workflows/trigger-pr-build.yml file records an untrusted fork commit in an artifact, which the .github/workflows/bui...
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
CVE-2026-55675: Improper Control of Generation of Code
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...
Salty Organization documents: Software supply chain vulnerabilities
The previous version of Salty Organization’s documentation contained a security vulnerability. This vulnerability stemmed from an untrusted fork submission recorded in the prinfo component via trigger-pr-build.yml. The build-pr.yml file checked out that submission and ran “pip install”, allowing...
Malicious code in salty_hookworm_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45905bf0c2192d27d0dfeb93b26f692a996b9f6d2ede4a5094e881facf07fda9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in salty_amphibian_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f8b6be7dd286119d4a8f96e6f907b671653e6e973937309091d087f0264f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-136816 Malicious code in salty_hookworm_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45905bf0c2192d27d0dfeb93b26f692a996b9f6d2ede4a5094e881facf07fda9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-102392
Malicious code in saltypinnipedz3n npm...
EUVD-2025-88945
Malicious code in saltymeadowlarkz3n npm...
EUVD-2025-88944
Malicious code in saltyscallopz3n npm...
EUVD-2025-75750
Malicious code in saltysloth-silentdev npm...
Malicious code in salty_tarsier-gooddev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14e2a72b3e55533acec13dfe16592140ba6d9bfda5737b701521e3684f7a1816 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-78373
Malicious code in saltybearz3n npm...
MAL-2025-96439 Malicious code in salty_shark_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b22d89deb756660db049c472a415e3f7c29d7a1ff352037f4c4b0243e948229 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...