North Korean Hackers Pull Off $308M Bitcoin Heist from Crypto Firm DMM Bitcoin

Japanese and U.S. authorities have formerly attributed the theft of cryptocurrency worth $308 million from cryptocurrency company DMM Bitcoin in May 2024 to North Korean cyber actors. "The theft is affiliated with TraderTraitor threat activity, which is also tracked as Jade Sleet, UNC4899, and Sl...

Malicious code in cloudinary-ct-run-sub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8b17191416c445db03bfceae872f6642a1171a2300b65df0c546dd5a1fc19bc The OpenSSF Package Analysis project identified 'cloudinary-ct-run-sub' @ 1.1.0 npm as malicious. It is considered malicious because: - The...

CVE-2024-12894

creationtimestamp| type| source ---|---|--- 2024-12-22 12:11:47+00:00| seen| https://infosec.exchange/users/cve/statuses/113696407969484827 2024-12-22 12:15:44+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3ldvffgxsve25 2024-12-22 13:54:25+00:00| seen|...

Malicious code in openai-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 025855a4aad79b7f6961770b428612b04f28558b5aaa0eafd1590c9bd641dcc0 The OpenSSF Package Analysis project identified 'openai-extension' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in conversations-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e54647ae689c5f7d3193ceb233f106eac2255d584c793de83b7de77dd086b2dc The OpenSSF Package Analysis project identified 'conversations-embed' @ 1.21.0 npm as malicious. It is considered malicious because: - The packa...

Malicious code in mono-faucet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a9b64ffe282d49a1f13db908a30b2713843c5dc3ac78ec52d50c8bcf450e401 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56357

creationtimestamp| type| source ---|---|--- 2024-12-20 20:29:37+00:00| seen| https://infosec.exchange/users/cve/statuses/113687040938359325 2024-12-20 21:15:43+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3ldrcmzzy3w2o 2024-12-20 23:26:35+00:00| seen|...

Malicious code in squirreldisk-tauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b61244e5ef1dd2b28d94395ad515353e3bcf1c00f2629376c95305ca4323e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12067 Malicious code in aauto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ef1fe2d72d5632ea92996b145c4713780023fe149d21e2f24e5ba190caf8100 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-42867

creationtimestamp| type| source ---|---|--- 2024-12-20 03:43:46+00:00| seen| https://infosec.exchange/users/cve/statuses/113683085800523490 2024-12-20 04:15:19+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3ldpjmkitwy2v 2024-12-20 05:52:22+00:00| seen|...

Malicious code in yandex-pandora-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7c8829575ea2c09d2db8f6f98a73635e882f6ac8084b06174761270128f3438 The OpenSSF Package Analysis project identified 'yandex-pandora-docs' @ 1.0.0 npm as malicious. It is considered malicious because: - The packag...

CVE-2024-56145

creationtimestamp| type| source ---|---|--- 2024-12-18 22:54:13+00:00| seen| https://t.me/cvedetector/13254 2024-12-19 03:15:06+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113677310750656920 2024-12-19 21:48:04+00:00| seen|...

CVE-2024-12694

creationtimestamp| type| source ---|---|--- 2024-12-18 21:49:01+00:00| seen| https://infosec.exchange/users/cve/statuses/113676028529416984 2024-12-18 22:16:24+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113676136226017385 2024-12-18 23:06:04+00:00| seen|...

Malicious code in bitmex-node-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc7c20df046cd10e263fa37bcda6196d91e23537ce001e8ed4b9598700ad8b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11915 Malicious code in ifood2-github-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a15f07f3dda7d132a00d57e04e31bc1c982857fc28d86ec6934974c3ad314723 The OpenSSF Package Analysis project identified 'ifood2-github-io' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Rockwell Automation PowerMonitor 1000 Remote

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform edit operations, create admin users, perform factory reset, execute arbitrary code, or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures...

Hitachi Energy TropOS Devices Series 1400/2400/6400

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for...

Malicious code in vue-cli-plugin-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...

Malicious code in vercel-repros (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 61ab9d6c179c19b7bd4e20a4c65605457887724fa5f2bd4e0abfcdea66f7ff2f The OpenSSF Package Analysis project identified 'vercel-repros' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11883 Malicious code in microsoft.applicationinsights.windowsapps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52a55ac73cfe94f23310de107d74ba82bfa2e8ae17f9742af50ef4e2da42c98d The OpenSSF Package Analysis project identified 'microsoft.applicationinsights.windowsapps' @ 99.99.99 npm as malicious. It is considered...