MAL-2022-2570 Malicious code in doom-workers-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea187c65ee7f8768c6ebe755e79017a5c014e3892dd3c10a6d81a698f285580e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3925 Malicious code in io.intercom.cordova.sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95d3158818ec3050c42c802391d0519c3f8d1e0120cd4908bcfb6690f3cccf54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-855 Malicious code in adelphi-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62529517e322d0077ccd0abb579f55691b51a840e24dbe989a19476798abadeb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2709 Malicious code in email-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a26f280816f19cb1307ffabf2da3a9ecf9e78f457545b2957088c98eb976447 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2470 Malicious code in dig-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c176c48e859438f13c62cd8bdc00448ce481a0e839891da1ab3211df7d387bb5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5525 Malicious code in purple_team_midway_3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e40f181749a8f708b27116a5ebf463e016a429d79b88a02dce3c38bbdeb65f38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1667 Malicious code in brave-bitgo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc083f0135dbe25e14931c86c5bb99d26642341eca8c6ac96803a1fff4cec2ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4127 Malicious code in kbrstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d9072fe6ef21cd33f568fee8388ccfff88f49a89fe47fc2ce374028e65d554f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-412 Malicious code in @manomano-toolbox/async-exports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ed6043d62007fd2c0e9cbb7d2c4c3f699d6f97ae27a7f8cc5744c19e9128c6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-607 Malicious code in @spinak/iac-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77099501462f80e29fcba9337b4c51a78859cfed8347211f50acbafee737a3ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1492 Malicious code in bebekair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f7bbcbf226b61f0938eddc89d049cfb4dfed9c1e0d18bd9566e68eb57d2d90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5072 Malicious code in on-running-script-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b99286f337b376ff84ea4a7b5c1e6c0a8edaef278aecf26b1543bc9d05212b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4735 Malicious code in multisig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4eb9c4b4228a3a5f5b0a57247fb0920a79451a4f5b183a7568412f2d8be3a61b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7389 Malicious code in zilliqa-exchange-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abfd66f13f5f9c577c71376fac31dab474c4661aa755ac57e48cff489861cbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5965 Malicious code in scilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb59474865c382bf4153fdb43653e3e82ded140b0d1abd2db8a26d5c087b8af8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4227 Malicious code in kruit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f6d59849346dac98e4f140f1bee01314c9ae375a1c209717e73cc3c2fe48e8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3868 Malicious code in internal-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d4583bea88824ef161eff89fddcfcad1437c405b759199306bc71b55930db9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts

The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...

Any user can start inflation for Minter.sol

Lines of code Vulnerability details Submitting as a high risk bug because it is equivalent to calling startInflation which is a function reserved for only governance to call and it drastically alters token distribution Impact Bypass governance only call restriction and cause immediate inflation...

MAL-2022-4290 Malicious code in lexical-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...