Malicious Package

Amendment This was deemed not a vulnerability. Overview dtautodevweb is a malicious package. Note: This package was uncovered by one of Snyk's automated algorithms, and was since confirmed to be a proof-of-concept package uploaded by a researcher. It has been removed from the ecosystem and does n...

Microsoft Security innovations from 2022 to help you create a safer world today

The start of a new year is always a great time for reflection—to be grateful for all we have and the progress security teams have made as well as look ahead to how we can reshape the security landscape. I use this time to think about goals for the future, and to reflect on the highlights,...

Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps

Researchers have shut down an "expansive" ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. "VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack...

ani-tui (>=0.1.0, <=0.2.1), atomic-server (>=0.33.0, <=0.34.0) +107 more potentially affected by unknown CVE via kuchiki (>=0.3.4, <=0.8.1)

kuchiki CARGO version =0.3.4, =0.1.0, =0.33.0, =0.33.0, =0.7.2, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.8.5 - curseforgewebview 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0019...

@0x4447/broccoli (>=1.0.0, <=1.0.16), @0x4447/potato (>=2.0.0, <=2.4.7) +426 more potentially affected by CVE-2021-4299 via string-kit (>=0.0.3, <=0.11.10)

string-kit NPM version =0.0.3, =1.0.0, =2.0.0, =1.0.0, =1.18.0, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =1.0.5-master.20190403074739, =1.0.0-M.5a, =0.1.0-master.20191109234452, =0.1.0-ipcrm-custom-event.20191122150318, =1.0.0-M.3, =1.2.2-master.20191206162119 - @atomist/sdm-pack-k8s...

FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape

An exhaustive analysis of FIN7 has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks. It has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct...

Microsoft research uncovers new Zerobot capabilities

Botnet malware operations are a constantly evolving threat to devices and networks. Threat actors target Internet of Things IoT devices for recruitment into malicious operations as IoT devices’ configurations often leave them exposed, and the number of internet-connected devices continue to grow...

[SECURITY] Fedora 37 Update: python3.10-3.10.9-1.fc37

Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.10 package provides the "python3.10" executable:...

Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages

NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors. "The packages were part of a new attack vector, with attackers spamming the open source ecosystem with packages containing links to phishing...

Pool.sol : Lack of slippage protection for swap

Lines of code Vulnerability details Impact Due to lack of slippage protection, user may suffer and incur loss of func in adverse condition. Proof of Concept Swap function is used to swap one toke for another token. While the swap function has check to ensure for exactOutput, but it does not have...

bioyino-metric (>=0.1.0, <=0.2.0), cafs (0.0.1) +29 more potentially affected by CVE-2022-46149 via capnp (>=0.0.1, <=0.12.4)

capnp CARGO version =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.5.0, =0.1.6, =0.2.8, =0.2.0, =0.17.0, =0.2.2, =0.6.0, =0.7.0 and more Source cves: CVE-2022-46149 Source advisory: OSV:GHSA-QQFF-4VW4-F6HX...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +3849 more potentially affected by CVE-2022-24999 via qs (>=6.5.0, <=6.5.2)

qs NPM version =6.5.0, =1.0.0, =0.2.0, =0.1.0, =1.0.0, =1.0.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =6.0.0, =7.12.0 and more Source cves: CVE-2022-24999 Source advisory: OSV:GHSA-HRPP-H998-J3PP...

@211la/search-client (>=0.1.0, <=0.5.0), @2bad/bitrix (>=2.0.0, <=2.3.0) +15 more potentially affected by CVE-2022-24999 via qs (6.8.0)

qs NPM version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on qs and may be impacted: - @211la/search-client =0.1.0, =2.0.0, =0.0.0-GO-1036-new-endpoint-to-download-bulk-details.3, =9.1.23-alpha2.60, =0.6.4, =2.1.1, =0.1.0, =3.4.5, =1.0.0, =0.1....

@1doc3/hermes-chat (>=0.0.0, <=0.4.74), @1doc3/synapse-wizard (>=0.0.0, <=0.5.119) +624 more potentially affected by unknown CVE via sweetalert2 (>=8.19.1, <=11.22.3)

sweetalert2 NPM version =8.19.1, =0.0.0, =0.0.0, =0.1.0, =2.31.0, =0.0.1-beta.1, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =0.0.9, =0.0.1, =0.3.73, =0.3.198 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8JH9-WQPF-Q52C...

100 Apps, Endless Security Checks

On average, organizations report using 102 business-critical SaaS applications, enabling operations of most departments across an organization, such as IT and Security, Sales, Marketing, R&D, Product Management, HR, Legal, Finance, and Enablement. An attack can come from any app, no matter how...

@abstraktor/actordemo (>=0.0.0-ad-beta.1, <=0.0.0-ad-beta.2), @abstraktor/actorjs (>=0.0.0-aj-alpha.9, <=0.0.0-aj-beta.6) +175 more potentially affected by CVE-2022-24066 +1 more via simple-git (>=3.0.3, <=3.14.1)

simple-git NPM version =3.0.3, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =1.4.0, =5.15.0, =10.0.0-version-usage.0, =1.0.1, =2.0.0, =1.1.0, =1.1.0, =0.0.0-semantic-release, =1.1.12, =0.0.1, =0.0.63 - @custis/file-adapter-front 1.1.1 and more Source cves: CVE-2022-24066, CVE-2022-25912 Source advisory:...

Researchers Uncover PyPI Package Hiding Malicious Code Behind Image File

A malicious package discovered on the Python Package Index PyPI has been found employing a steganographic trick to conceal malicious code within image files. The package in question, named "apicolor," was uploaded to the Python third-party repository on October 31, 2022, and described as a "Core...

OnePlanet Announces Support for Polygon-based Launchpad Services

By Deeba Ahmed This connectivity between the NFT launchpad and the Polygon ecosystem will allow the minting of new collections on the Polygon network. This is a post from HackRead.com Read the original post: OnePlanet Announces Support for Polygon-based Launchpad Services...

@apexdevtools/apex-ls (>=3.1.0, <=3.2.0), @appium/fake-driver (>=3.2.3, <=3.2.4) +47 more potentially affected by CVE-2022-39353 via @xmldom/xmldom (>=0.7.0, <=0.7.6)

@xmldom/xmldom NPM version =0.7.0, =3.1.0, =3.2.3, =1.0.0-beta1, =15.1.0, =15.1.0, =15.1.0, =15.1.0, =0.1.0-beta.57, =0.1.5-beta.1, =1.0.0, =1.0.0, =1.0.0, =1.0.11 and more Source cves: CVE-2022-39353 Source advisory: OSV:GHSA-CRH6-FP67-6883...

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

Microsoft has discovered recent activity indicating that the Raspberry Robin worm is part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread. These infections lead to follow-on...