Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

MAL-2026-18519 Malicious code in service-roles-registry (npm)

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 published 2026-11-02 17:53 UTC: its preinstall script is node index.js, which npm runs during npm...

Malicious code in @mobile-platform/magnetic-components (npm)

@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves @mobile-platform from npm runs its code instead of...

Malicious code in ms-client-portal (npm)

ms-client-portal is a dependency-confusion package with no functional code; its README says the name is an internal project name exposed in the production web bundle of a health-sector client portal. Its preinstall and postinstall scripts each run a node -e one-liner on npm install that sends an...

MAL-2026-18504 Malicious code in @goparrot-dashboard/loyalty (npm)

@goparrot-dashboard/loyalty is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...

Malicious code in @goparrot-dashboard/menu (npm)

@goparrot-dashboard/menu is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard-api/shared (npm)

@goparrot-dashboard-api/shared is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

MAL-2026-18510 Malicious code in @goparrot-dashboard/settings (npm)

@goparrot-dashboard/settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

MAL-2026-18501 Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)

@goparrot-dashboard/franchise-menu-settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same...

Malicious code in @goparrot-dashboard/store (npm)

@goparrot-dashboard/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

MAL-2026-18495 Malicious code in @goparrot-dashboard/category (npm)

@goparrot-dashboard/category is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/promotion (npm)

@goparrot-dashboard/promotion is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

MAL-2026-18516 Malicious code in @goparrot-dashboard-api/users (npm)

@goparrot-dashboard-api/users is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...

MAL-2026-18505 Malicious code in @goparrot-dashboard/marketing (npm)

@goparrot-dashboard/marketing is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

MAL-2026-18507 Malicious code in @goparrot-dashboard/order (npm)

@goparrot-dashboard/order is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

MAL-2026-18511 Malicious code in @goparrot-dashboard/store (npm)

@goparrot-dashboard/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

MAL-2026-18515 Malicious code in @goparrot-dashboard-api/store (npm)

@goparrot-dashboard-api/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...