MAL-2024-8046 Malicious code in artifact-lab-3-package-89883da3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc3109f451995d11f0f2e99d58397d06ac2bb036df5ceb90425befb54ea10f14 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-7824 Malicious code in prnigtest (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 147f57eb0168a1a9093112e166c5cdb4e5469034b85ac74127934cf3b8b239f7 Source: ossf-package-analysis 33de2220f578380a865d6c3698c4b14d12094a22c8689b41c0aa1215860ca676 The OpenSSF Package Analysis project identified 'prnigtest...

MAL-2024-7814 Malicious code in ent-widget-gender (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2c0c2b743a2c55939970f237481ed095952aa3b07c769580ed7564e1be2f14b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10238 Malicious code in 123bla (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d085ff0850c519ea81f21c8be37968a923d4d162e126c3ded06c482b7bdadd36 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-7767 Malicious code in @playsistemico/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 630104848acd582d628c24e45dc9472952d21452b641115bb0d9fd3eabb2a5dc The OpenSSF Package Analysis project identified '@playsistemico/core' @ 11.33.70 npm as malicious. It is considered malicious because: - The...

MAL-2024-7655 Malicious code in sap-callerid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaf954365d809a7ff5859e9f1797a1acb30ac55273ed61e83c468025645b7116 The OpenSSF Package Analysis project identified 'sap-callerid' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7437 Malicious code in job-specs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 33cc6191f6fbd8274e7eb5fe159654ded5d7fadbdc6fe26dbb62b26c0ddd42ed The OpenSSF Package Analysis project identified 'job-specs' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7178 Malicious code in @zitterorg/dolores-perspiciatis-rem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a518bc244351979012d9f74ce36995dd87c58c357369bd0925367f85acc8c074 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1641 Malicious code in @wdpx/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 027f3f6ecca8b2d2bd6a4d8c6b358eb1ea8ea1f094cfe3d2606095b6b17d822f The OpenSSF Package Analysis project identified '@wdpx/themes' @ 3.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1630 Malicious code in mvp-website-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89574af4bb00d4c540ffc8651f5ef4bcc0f72af2368ee6e32346807e91d2e8a0 The OpenSSF Package Analysis project identified 'mvp-website-html' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1557 Malicious code in glamorous-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a6ea39de6911785f412a5a42905522010930dec6afece74458f8b4859a0fce5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1543 Malicious code in ing-shared-navigation-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74f93af2ce71593d4858563cf9cb0ae31150636aef60cad09f5ad639edda6194 The OpenSSF Package Analysis project identified 'ing-shared-navigation-de' @ 200.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-1539 Malicious code in mapbox-demo-gl-style-spec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa5a509685be972fc15ceb454b2c3768fd8dd7c5162f11471642ab34e1f34fb9 The OpenSSF Package Analysis project identified 'mapbox-demo-gl-style-spec' @ 14.4.0 npm as malicious. It is considered malicious because: - The...

openssl: AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries

A vulnerability was found in OpenSSL. The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries, which are unauthenticated as a consequence. Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can...

AES-SIV implementation ignores empty associated data entries (CVE-2023-2975)

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be...

Who Stole 3.6M Tax Records from South Carolina?

For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the states revenue department in 2012 and stealing tax and bank account information for 3.6 million people. The answer may no longer be a...

MAL-2024-1160 Malicious code in xko2x (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9088a22cb637f620235729c3503e7ab8b9a11fb9469c5742b88fbcfd32be15dd The OpenSSF Package Analysis project identified 'xko2x' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates...

MAL-2024-1183 Malicious code in teslamotors-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ff47ce37cbaa6b68373ed17ef85fe4403bf2b4865e9ef971a397714d2f7b8cce The OpenSSF Package Analysis project identified 'teslamotors-server' @ 99.2.0 npm as malicious. It is considered malicious because: - The packag...

MAL-2024-1145 Malicious code in odyssey-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0b408f794010d1926bb9841d26fd28c91c97d8f11d71acea664c92ccb5a06a54 The OpenSSF Package Analysis project identified 'odyssey-lint-staged' @ 9.9.5 npm as malicious. It is considered malicious because: - The packag...

MAL-2024-1100 Malicious code in ouramerica-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5e8ad6206cb55fdcb549168be1855e019bdc7745420d9b12074c0d682e66d50 The OpenSSF Package Analysis project identified 'ouramerica-constants' @ 1.0.0 npm as malicious. It is considered malicious because: - The packa...