fleet

News · Report a bug · Docs · Why open source? · Art Open-source platform for IT and security teams with thousands of computers. Designed for APIs, GitOps, webhooks, YAML, and humans. What's it for? Fleet gives you a single system to secure and maintain all your computing devices over the air. You...

CircleCI Configuration File - Detect

CircleCI config.yml file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CircleCI config.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CircleCI Configuration File - Detect', 'description': 'CircleCI...

CircleCI SSH Configuration - Detect

CircleCI ssh-config file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CircleCI ssh-config file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CircleCI SSH Configuration - Detect',...

Malicious code in generator-go-circleci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff938c3edbce8d3776448005a489240ddb234790867c0c0d34109efb170e9fec The package generator-go-circleci was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3346 Malicious code in generator-go-circleci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff938c3edbce8d3776448005a489240ddb234790867c0c0d34109efb170e9fec The package generator-go-circleci was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview generator-go-circleci is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@circleci/agents (>=2.4.0-canary.0ba816b, <=2.17.2), @lfades/next-code (>=0.0.1, <=0.0.2) +3 more potentially affected by CVE-2026-22813 via opencode-ai (>=0.6.5, <=1.1.8)

opencode-ai NPM version =0.6.5, =2.4.0-canary.0ba816b, =0.0.1, =0.1.0, =0.3.3, =0.1.9, =0.5.7 Source cves: CVE-2026-22813 Source advisory: MEND:CVE-2026-22813...

@circleci/agents (>=2.4.0-canary.0ba816b, <=2.17.2), @lfades/next-code (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-22812 via opencode-ai (>=0.6.5, <=1.0.123)

opencode-ai NPM version =0.6.5, =2.4.0-canary.0ba816b, =0.0.1, =0.1.0, =0.1.9, =0.5.7 Source cves: CVE-2026-22812 Source advisory: MEND:CVE-2026-22812...

EUVD-2025-199424

Malicious code in @voiceflow/circleci-config-sdk-orb-import npm...

Malicious Package

Overview circleci-docs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-48486 Malicious code in circleci-docs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d54b71e0248eb8babb0f78827eff5338450108a9cb2814de5573278a5eac86c Any computer that has this package installed or running should be considered...

Malicious code in circleci-docs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d54b71e0248eb8babb0f78827eff5338450108a9cb2814de5573278a5eac86c Any computer that has this package installed or running should be considered...

SaaS Breaches Start with Tokens - What Security Teams Must Watch

Token theft is a leading cause of SaaS breaches. Discover why OAuth and API tokens are often overlooked and how security teams can strengthen token hygiene to prevent attacks. Most companies in 2025 rely on a whole range of software-as-a-service SaaS applications to run their operations. However,...

@circleci/agents (>=1.0.6, <=2.10.0), @digipair/skill-codex (>=0.99.1, <=0.144.1) +3 more potentially affected by CVE-2025-59532 via @openai/codex (>=0.8.0, <=0.29.0)

@openai/codex NPM version =0.8.0, =1.0.6, =0.99.1, =0.0.1, =0.1.0, =0.99.1, =0.144.1 Source cves: CVE-2025-59532 Source advisory: MEND:CVE-2025-59532...

Malicious code in circleci-test (npm)

The package circleci-test was found to contain malicious code...

MAL-2025-17052 Malicious code in circleci-test (npm)

The package circleci-test was found to contain malicious code...

@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +4 more potentially affected by CVE-2025-54558 via @openai/codex (>=0.1.2504211509, <=0.8.0)

@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.23.0, =1.0.0, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2025-54558 Source advisory: MEND:CVE-2025-54558...

AWS, Google, and Azure CLI Tools Could Leak Credentials in Build Logs

New cybersecurity research has found that command-line interface CLI tools from Amazon Web Services AWS and Google Cloud can expose sensitive credentials in build logs, posing significant risks to organizations. The vulnerability has been codenamed LeakyCLI by cloud security firm Orca. "Some...

Reflecting on supply chain attacks halfway through 2023

Welcome to this weeks edition of the Threat Source newsletter. Between the Talos Takes episode last week and helping my colleague Hazel with the Half-Year in Review, I realized how much I had already forgotten about 2023 already. Its been a whirlwind, personally and professionally, and I think it...

Uncovering (and Understanding) the Hidden Risks of SaaS Apps

Recent data breaches across CircleCI, LastPass, and Okta underscore a common theme: The enterprise SaaS stacks connected to these industry-leading apps can be at serious risk for compromise. CircleCI, for example, plays an integral, SaaS-to-SaaS role for SaaS app development. Similarly, tens of...