Malicious Package

Overview @liquid-web/models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview naya-flore is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate legitimate WhatsApp libraries, there is no connection between that organization and this package...

Malicious Package

Overview proc-log-cmd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cookie-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview request-helmet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2024-25173 · Unknown · Jerryscript

Name of the Vulnerable Software and Affected Versions: Jerryscript version cefd391 Description: A segmentation violation was discovered in Jerryscript via the component scanner seek at jerry-core/parser/js/js-scanner-util.c. Recommendations: For Jerryscript version cefd391, consider avoiding the...

CVE-2024-28851 Elevation of privilege in Snowflake Hive MetaStore Connector Helper script

The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a helper script for the Hive MetaStore Connector. A malicious insider without admin privileges...

Malicious Package

Overview @b2bgeo/ci-startrek is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious Package

Overview @yandex-travel/ts-config is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

PT-2022-25831 · D8S-Yaml +1 · D8S-Yaml +1

Name of the Vulnerable Software and Affected Versions: d8s-yaml version 0.1.0 Description: The d8s-yaml package for Python contains a potential code-execution backdoor. This backdoor is attributed to the democritus-file-system package, which was inserted by a third party. Recommendations: For...

Malicious Package

Overview democritus-dates is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-dates package. References - GitHub Issue - GitHu...

Malicious Package

Overview @epc-infra/edge-stack is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview gctor-storage is a malicious package. The package enumerates and exfiltrates sensitive information from the host machine. Remediation Avoid using all malicious instances of the gctor-storage package. Credit: Snyk Research Team...

Malicious Package

Overview duckc2-v5.5.5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview active-admin-advancedcreateanother is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoi...

Malicious Package

Overview actionmailer-localized-preview is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid...

Malicious Package

Overview android-stringresourcesvalidator is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid...

Malicious Package

Overview action-cablesubscriptionadapter is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid...

Malicious Package

Overview a1520mk-exercise4 is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview activerecord-globalize is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...