MAL-2022-1362 Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @adam_baldwin/pingback (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f588b73737abec3fff361bbdc2e62cf8bd2969cbff8e191ce69b6bb349dfbcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3297 Malicious code in gc-gsl-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4adc0fa0f46c847c26f536f6d3390e092f77b6f9a533eaab32b95b5cf83499 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-705 Malicious code in @visiology-public-utilities/language-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb6fde7c58e6f10f65bd120f8200c7d1b94b54fd559d5640e208172dbe466ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-367 Malicious code in @iwcp/nebula-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46e24fcc1ba62a0b1cb165fdc4b1075ef12d23d1cf279ec8a71caff22937949b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5817 Malicious code in rkpacktest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64e155982820eba462dcbfa1616d8d13143172fae3248f9487a1d66ecfb674aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mad-expo-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b6c233978f8ced2a4470f669433a149ad554d58778e96f615d0dfbc7275c9f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @clover-microapp/utils-isomorphic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 482eb0aee6eec7e82d910ad31d6b3b39e0f154377bc5ae979f98fa6b984fae01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testapp00009 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fb396ef5f846069b4adb5738c3c1f69ea523ac3b4b516f1437304f6cdd35f69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-940 Malicious code in alimaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d481848faa4833bf11ea9a51708d0021a724f1132e8bb190a94c2c28c0147397 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1991 Malicious code in coldstone-sls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72ac39360f255a45fb8e4b2e5d51651953e42f65c88e3db649b633eb728d5c27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @epc-infra/app-lookup-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bbe84e4aa37a9b2484d307db5f4e3ac6dc202acbd2d528d2949bd1c1ce0e43c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-236 Malicious code in @epc-infra/app-lookup-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bbe84e4aa37a9b2484d307db5f4e3ac6dc202acbd2d528d2949bd1c1ce0e43c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-248 Malicious code in @epc-libraries/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 513bf18f392186904a1d77dd47476bde881e1a8f377dc070998c5d1625e72b7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1929 Malicious code in clinstestpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6575bc8b9c9df76806967bea87397ecc8df21860f0a7f91b4e5a8ffc317e8db8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @epc-infra/aurora-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90cf861bd2521b2e50dc30a7c5164cfd3c53a724597ffc85a923d730662346b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @epc-infra/users-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf73169208787ddafa275f2837c6596a96541a2c4b1526a4cdd468678bfa4e47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-GV2H-GF8M-R68J Exposure of server configuration in github.com/go-vela/server

Impact What kind of vulnerability is it? Who is impacted? The ability to expose configuration set in the Vela server via pipeline template functionality. It impacts all users of Vela. Sample of template exposing server configuration using Sprig's env function: yaml metadata: template: true steps:...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

Code injection

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...