Malicious code in pinochiomathm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 135c673bb3925502b10f92d9819d956004ade25faa9c358f6d3fb2c67cd6114e The package impersonates picomatch name 'pinochiomathm', description copied from picomatch, homepage pointing at github.com/micromatch/picomach. On...

nepali-sentiment-analysis (>=0.1.0, <=1.0.0) potentially affected by CVE-2026-9856 via transformers (4.16.1)

transformers PYPI version 4.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nepali-sentiment-analysis =0.1.0, =1.0.0 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2026-9856 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

PCAPdroid v2.0.1

PCAPdroid PCAPdroid is a privacy-friendly open source app which lets you track, analyze and block the connections made by the other apps in your device. It also allows you to export a PCAP dump of the traffic, inspect HTTP, decrypt TLS traffic and much more! PCAPdroid simulates a VPN in order to...

firmware-analysis-toolkit v2.0.0-alpha.1

FAT — Firmware Analysis Toolkit Download the latest release · Changelog · Installation Firmware Analysis Toolkit is a security research toolkit for investigating firmware security for IoT, Physical AI, Mobile Devices & Robotics. It is primarily built for the "Offensive IoT Exploitation" training...

mobileAudit v3.2.0

Mobile Audit Security analysis for Android APKs, from upload to actionable findings. Mobile Audit is a Django application for static application security testing and malware inspection. It extracts APK metadata, detects risky implementation patterns, organizes findings by severity, and provides a...

tlsx v1.4.0

Features • Installation • Usage • Running tlsx • Join Discord A fast and configurable TLS grabber focused on TLS based data collection and analysis. Features Fast And fully configurable TLS Connection Multiple Modes for TLS Connection Multiple TLS probes Auto TLS Fallback for older TLS version Pr...

PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA

Five years after the enforcement of the California Consumer Privacy Act CCPA, understanding how website privacy practices evolve at scale in response to regulation remains a key challenge for both researchers and regulators. Prior work and regulatory efforts have focused on manual and case-specif...

Joern 4.0.624

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CodeQL 2.27.0

Discover vulnerabilities across a codebase with CodeQL, an industry-leading semantic code analysis engine. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same...

No-Box Vulnerability Analysis: Description-Only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

Conventional vulnerability analysis relies on either system access or dynamic interaction, all of which may be unavailable to third-party analysts auditing closed-source, remotely hosted, critical in situ systems, or commercially gated software. Therefore, we propose a new paradigm of no-box...

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

ReDoS vulnerabilities are a type of denial of service software weakness that occurs when a regex is used to validate user-supplied input. In some cases, the regex matching process can take exponential time, leading to a denial of service. In this study, we examine and compare the effectiveness of...

CARTS: Contextual Autoregressive Rank Transcoding Steganography for Full-Capacity Keyed Text Encoding

Autoregressive language models can be used to transform a payload text into a stegotext of identical token length by preserving per-position rank information across contexts - a methodology we formalize as Contextual Autoregressive Rank Transcoding Steganography CARTS. While the Calgacus...

Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation

Static analysis remains a cornerstone of software security, yet the effectiveness of tools such as CodeQL is often limited by the substantial manual effort required to develop high-coverage query suites. While large language models LLMs have emerged as a potential solution for automated code...

preflight v0.22.0

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...

log-horizon v0.9.0

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

Joern 4.0.623

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Parse Server Privilege Escalation

The vulnerability of the GitHub CI workflow server for syntax analysis in Parse Server is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information and enhance their privileges...

r2frida v6.2.2

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

radare2 v6.2.2

Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.4, next release will be 6.2.5. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...