compromised-action

compromised-action 测试仓库：模拟CVE-2025-30066风格的被攻陷的GitHub Action（用于安全研究/测试chainradar）...

CVE-2026-61446

PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python .py files from project-level and user-home .praisonai/plugins/ directories using importlib specfromfilelocation and execmodule without code...

Malicious code in tns-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 186bfba0931ba063bd6e71325785b97c646cbfaaf91c4dca876653673d29c0cc Package is prepared to exfiltrate environmental variables. The wording used clearly states it's part of a campaign targeting cryptocurrency users via malicious...

MAL-2026-3043 Malicious code in rosolver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0904af239ce7e030d9cde78de066412fb3942a4b12ea8be5c5d45681417230fc During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in robase-help (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b83143e22b0a815d6a2702f547ae9f4620ee086c8b9360a0d60ff2ed2186d56b During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

@kash_tt/common (>=1.0.1, <=1.1.236), @topperdev17/common (>=1.0.0, <=2.0.1) +6 more potentially affected by unknown CVE via typecript (0.0.1-security)

typecript NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on typecript and may be impacted: - @kashtt/common =1.0.1, =1.0.0, =1.0.3, =1.0.53, =0.0.1, =1.0.5, =1.0.14 - tant-intl-new 1.0.14 Source cves: unknown CVE Source advisor...