PT-2024-31385 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.1 Description: The issue allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author...

Malicious code in @desesap289/dev_dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac047c7ec6034e7a80c74ca32646da104b86b3f39c46f7f836deeebebeb53b20 The OpenSSF Package Analysis project identified '@desesap289/devdependency' @ 10.20.9 npm as malicious. It is considered malicious because: - Th...

Malicious code in @ep-mobile/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8898d3fb5c1fead4de584f7a8099d3df0886074a50f328df051524976dda9be2 The OpenSSF Package Analysis project identified '@ep-mobile/icons' @ 99.99.99 npm as malicious. It is considered malicious because: - The packag...

Malicious code in td-emerald-standards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2f97f10309683aa0addae921845bdf8ce584670d8640544b7eeb2c41501e7af The OpenSSF Package Analysis project identified 'td-emerald-standards' @ 6.6.6 npm as malicious. It is considered malicious because: - The packa...

Malicious code in @google-research/retvecjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f7a64d316c75e0e53a3a525a50d591725648d0064b5f1d5c622b3c94ef5aaf30 The OpenSSF Package Analysis project identified '@google-research/retvecjs' @ 100.999.99 npm as malicious. It is considered malicious because: -...

Malicious code in artifact-lab-3-package-392c6acd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ada0f9ebcf3f190d513b34099887d36ad38579e9c5b5d2004a8f0bff5565e100 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

Malicious code in gdpr-cookie-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4b030241c0f342d263d8d7bb420da387e10189d78cc0201bb34cd2ac047d6764 The OpenSSF Package Analysis project identified 'gdpr-cookie-consent' @ 3.0.6 npm as malicious. It is considered malicious because: - The packag...

Malicious code in @taxify/city-borders (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 041f06eacb4e8e5ffe66ccd96009305833355630bf63940b876d7c7f3ce7bd55 The OpenSSF Package Analysis project identified '@taxify/city-borders' @ 10.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in @taxify/trippricing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ea65d71551b4d01fb99a1bfe5236b0d5c80c0b566ae60d044b71857883f17b21 The OpenSSF Package Analysis project identified '@taxify/trippricing' @ 9.999.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-7899 Malicious code in @taxify/smartpickups (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d20e7ecf4639b1082be1a46fec756d84cc7d8fc35310af0e6af87e19879fcf7 The OpenSSF Package Analysis project identified '@taxify/smartpickups' @ 9.999.0 npm as malicious. It is considered malicious because: - The...

Malicious code in nvmfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 147e71ec4a806f079f678e7df61fa161680442319b62f425a34e7e8bd87b1e85 The OpenSSF Package Analysis project identified 'nvmfix' @ 1.0.3 npm as malicious. It is considered malicious because: - The package communicate...

Malicious code in httpsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0e64993dc2fc1fcf09ccd51e2f05f711cd08217f3f32fe72847a0e545ab39199 The OpenSSF Package Analysis project identified 'httpsearch' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

Malicious code in miapimanager-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a1401d4d9e906af349022a130fd98dff7fd5a66545792c1f31587312907431e6 The OpenSSF Package Analysis project identified 'miapimanager-fe' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in hlwgirl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 70e129077e409b307127c9a7e24115d3838f7a8748b65fcc22df02cf79af94e7 The OpenSSF Package Analysis project identified 'hlwgirl' @ 1.99.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in zapier-elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 98a72694a59e2b2fa9040cc6e3b823a0e1dabe2ebd53ea16ebd7afbfb8306e01 The OpenSSF Package Analysis project identified 'zapier-elements' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in byted-cg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90e251b9f3c49de738ecec6d31759290c20383f748735d901d797110fd1b6fb2 The OpenSSF Package Analysis project identified 'byted-cg' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7830 Malicious code in symphony-familiarity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eff03dd28a4225440b053e0619ca9619d5c18fbd90e59b8513587d836b4df052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ml-keyframer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07ec4b17c5706200b2e45890a6bdc64b07c775904116aa6a09c5bfd8473d16d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in packagemurder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0245dc4dcc2cb31e6eb932d557081b0ef9dc493765b8f56d1fd61fdf70fb207a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in cugraph-service-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0246f55913ed7c36615843f23e434366bb7e1491332d526c91700a891ee8fde7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...