VULSOVER: Vulnerability Detection Via LLM-Driven Constraint Solving

Traditional vulnerability detection methods rely heavily on predefined rule matching, which often fails to capture vulnerabilities accurately. With the rise of large language models LLMs, leveraging their ability to understand code semantics has emerged as a promising direction for achieving more...

Virtual Reality, Real Problems: a Longitudinal Security Analysis of VR Firmware

Virtual Reality VR technology is rapidly growing in recent years. VR devices such as Meta Quest 3 utilize numerous sensors to collect users' data to provide an immersive experience. Due to the extensive data collection and the immersive nature, the security of VR devices is paramount. Leading VR...

Malicious code in @callcenter-frontend/shared-types (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f78119137abb744cf51b995b836463c88b03fb249997685f0e4a2feb7ef621e The OpenSSF Package Analysis project identified...

MAL-2025-41973 Malicious code in error-analysis (npm)

The package error-analysis was found to contain malicious code...

Malicious code in error-analysis (npm)

The package error-analysis was found to contain malicious code...

Malicious code in react-media-template-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5a2fff48804ddfb5297954a2040eb8f90fd5ca36c31568a46d56d860ecf47148 The OpenSSF Package Analysis project identified 'react-media-template-ts' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

Malicious code in typescript-api-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 398036095e479d925d07bcf55655437c9689808b7e019efbbfc071fcd4c459ac The OpenSSF Package Analysis project identified 'typescript-api-project' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

Malicious code in ambmock.sol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3325e3e3e4d5da75f9755d2ad28d8e50b9339069afd9e0ed75cfcee080e3eed The OpenSSF Package Analysis project identified 'ambmock.sol' @ 1337.0.0 npm as malicious. It is considered malicious because: - The package...

Detecting Stealthy Data Poisoning Attacks in AI Code Generators

Deep learning DL models for natural language-to-code generation have become integral to modern software development pipelines. However, their heavy reliance on large amounts of data, often collected from unsanitized online sources, exposes them to data poisoning attacks, where adversaries inject...

Malicious code in azure-ipam-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 44b5c0e4141f25b2fb25c0fcd206aa203961a4a13336461bab2825b51576f88d The OpenSSF Package Analysis project identified 'azure-ipam-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

The WASM Cloak: Evaluating Browser Fingerprinting Defenses under WebAssembly Based Obfuscation

Browser fingerprinting defenses have historically focused on detecting JavaScriptJS-based tracking techniques. However, the widespread adoption of WebAssembly WASM introduces a potential blind spot, as adversaries can convert JS to WASM's low-level binary format to obfuscate malicious logic. This...

Malicious code in @flight-common/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f79d53932b1163ec8f1f13fbb18de9439278bcf7ee1fe90dcd53d0349d24b72 The OpenSSF Package Analysis project identified '@flight-common/services' @ 1.2.9213 npm as malicious. It is considered malicious because: - The...

Malicious code in @liquid-web/core-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f9afbcbd82f8b0c7374b5e9edb81329aa506296ef39a5a63d70d59af7591e74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @flight-common/models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5af2423bce8f82ab3bebfecba472bdcc04805388481ec19e96c245ca48ccd3b The OpenSSF Package Analysis project identified '@flight-common/models' @ 1.2.9213 npm as malicious. It is considered malicious because: - The...

MAL-2025-42122 Malicious code in @flight-common/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10b5cb816f030297707c6e9ae79f7916de698fd58c8b068b18ef716c7425240b The OpenSSF Package Analysis project identified '@flight-common/components' @ 1.2.9213 npm as malicious. It is considered malicious because: - T...

Faraday 5.16.0

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

Linux Distros Unpatched Vulnerability : CVE-2022-3767

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless ...

Linux Distros Unpatched Vulnerability : CVE-2022-28070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A null pointer deference in coreanalfcn function in radare2 5.4.2 and 5.4.0. CVE-2022-28070 Note that Nessus relies on the presence of the package as reported b...

Zeek 8.0.1

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

Malicious code in uitk_i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc864b28374d03fb38eaeac8bc4b8479334114789acb4be7c5f43a9a738d990c The OpenSSF Package Analysis project identified 'uitki18n' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execute...