Wrap Up the Year with the Biggest Scope and Rewards Yet: Join the Wordfence Bug Bounty Program End of Year Holiday Extravaganza!

The holidays are here, and so is your chance to earn big while helping secure the WordPress ecosystem! For all submissions to our Bug Bounty Program from November 12, 2024, to December 9, 2024 , we’re rolling out our End of Year Holiday Extravaganza promotion to give back to our security...

Malicious NPM Packages Target Roblox Users with Data-Stealing Malware

A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber. "This incident highlights the alarming ease with which threat actors can launch supply chain attack...

@casablanca-css/core (0.2.0), @nuxtjs/device (>=3.2.0, <=3.2.2) +4 more potentially affected by CVE-2024-51757 via happy-dom (>=15.0.0, <=15.7.4)

happy-dom NPM version =15.0.0, =3.2.0, =6.0.1, =4.1.4, =5.1.4, =1.1.78, =1.1.79 Source cves: CVE-2024-51757 Source advisory: OSV:GHSA-96G7-G7G9-JXW8...

Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages

An ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware. The attack is notable for utilizing Ethereum smart contracts for command-and-control C2 server address distribution...

Inside the Massive Crime Industry That’s Hacking Billion-Dollar Companies

When you download a piece of pirated software, you might also be getting a piece of infostealer malware, and entering a highly complex hacking ecosystem that’s fueling some of the biggest breaches on the planet...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +510 more potentially affected by CVE-2024-7774 via langchain (>=0.0.11, <=0.2.10)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.0.2, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt 0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: OSV:GHSA-HC5W-C9F8-9CC4...

[SECURITY] Fedora 41 Update: rust-pyo3-build-config-0.22.4-1.fc41

Build configuration for the PyO3 ecosystem...

[SECURITY] Fedora 41 Update: rust-pyo3-ffi-0.22.4-1.fc41

Python-API bindings for the PyO3 ecosystem...

b4ae (>=2.0.0, <=2.1.3), clatter (>=0.1.2-alpha, <=2.0.0-rc.1) +28 more potentially affected by unknown CVE via pqcrypto-kyber (>=0.1.2, <=0.8.1)

pqcrypto-kyber CARGO version =0.1.2, =2.0.0, =0.1.2-alpha, =0.1.4, =0.1.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0 - qudag-exchange 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0381...

[SECURITY] Fedora 40 Update: rust-pyo3-ffi-0.22.4-1.fc40

Python-API bindings for the PyO3 ecosystem...

[SECURITY] Fedora 40 Update: rust-pyo3-build-config-0.22.4-1.fc40

Build configuration for the PyO3 ecosystem...

[SECURITY] Fedora 39 Update: rust-pyo3-build-config-0.22.4-1.fc39

Build configuration for the PyO3 ecosystem...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +1056 more potentially affected by CVE-2024-47875 via dompurify (>=2.0.0, <=2.4.9)

dompurify NPM version =2.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =6.2.3, =6.4.3, =0.0.2-next.4, =0.3.0, =0.1.0, =0.1.0-a0, =1.0.0, =0.4.0, =0.0.18, =0.0.32 and more Source cves: CVE-2024-47875 Source advisory: OSV:GHSA-GX9M-WHJM-85JF...

@belym.a.2105/publish-please (>=2.4.0-alpha.0, <=2.4.1), @digitalnative/standard-protocol-sdk (>=0.0.190, <=0.0.195) +48 more potentially affected by CVE-2024-21532 via ggit (>=2.0.0, <=2.4.12)

ggit NPM version =2.0.0, =2.4.0-alpha.0, =0.0.190, =1.1.2, =0.1.0, =4.1.6, =0.1.0, =0.1.0, =0.0.1, =1.7.3, =1.0.0, =0.13.4, =1.9.1, =1.0.0, =1.21.0, =1.23.3 and more Source cves: CVE-2024-21532 Source advisory: OSV:GHSA-62CX-5XJ4-WFM4...

Google Blocks Unsafe Android App Sideloading in India for Improved Fraud Protection

Google has announced that it's piloting a new security initiative that automatically blocks sideloading of potentially unsafe Android apps in India, after similar tests in Singapore, Thailand, and Brazil. The enhanced fraud protection feature aims to keep users safe when they attempt to install...

a-bot (0.0.1), a-gpt (>=0.1.0, <=0.4.0) +24321 more potentially affected by unknown CVE via atty (>=0.1.2, <=0.2.14)

atty CARGO version =0.1.2, =0.1.0, =0.0.5, =0.2.0, =0.0.1, =0.0.2, =0.4.1, =0.9.0, =0.1.0, =0.2.1, =1.0.3, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0375...

0.2-ui (0.0.1), 1k-tasks (>=2.3.0, <=3.0.2) +2350 more potentially affected by CVE-2024-47068 via rollup (>=2.0.0, <=2.79.1)

rollup NPM version =2.0.0, =2.3.0, =1.0.17, =1.0.0-canary.1, =1.0.0, =0.0.10, =0.0.3, =1.0.1, =1.0.12, =1.0.0, =0.0.4, =3.1.0-next.7, =3.1.0-next.7, =3.1.0-rc.2 and more Source cves: CVE-2024-47068 Source advisory: OSV:GHSA-GCX4-MW62-G8WM...

protobuf-java has potential Denial of Service issue

Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both t...

01-numacert (>=1.0.0, <=3.0.0), 02-infrastructure (1.0.0) +20271 more potentially affected by CVE-2024-43800 via serve-static (>=1.0.1, <=1.15.0)

serve-static NPM version =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.0.3, =1.0.11 - 2-angular 1.0.0 - 20190403-utils 1.0.0 - 20231122-npm 1.0.0 - 2048.io 0.0.1 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

Malicious npm Packages Mimicking 'noblox.js' Compromise Roblox Developers' Systems

Roblox developers are the target of a persistent campaign that seeks to compromise systems through bogus npm packages, once again underscoring how threat actors continue to exploit the trust in the open-source ecosystem to deliver malware. "By mimicking the popular 'noblox.js' library, attackers...