MAL-2022-5965 Malicious code in scilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb59474865c382bf4153fdb43653e3e82ded140b0d1abd2db8a26d5c087b8af8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7389 Malicious code in zilliqa-exchange-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abfd66f13f5f9c577c71376fac31dab474c4661aa755ac57e48cff489861cbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4227 Malicious code in kruit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f6d59849346dac98e4f140f1bee01314c9ae375a1c209717e73cc3c2fe48e8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3868 Malicious code in internal-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d4583bea88824ef161eff89fddcfcad1437c405b759199306bc71b55930db9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts

The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...

Any user can start inflation for Minter.sol

Lines of code Vulnerability details Submitting as a high risk bug because it is equivalent to calling startInflation which is a function reserved for only governance to call and it drastically alters token distribution Impact Bypass governance only call restriction and cause immediate inflation...

MAL-2022-4290 Malicious code in lexical-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6068 Malicious code in sg-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ac39fd960a239453b0464c0a79b0727b241130740cdb9544e514cf39f7d8a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3918 Malicious code in inv-cyber-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e992b95056bfc349eb310e76c92712b6661c990d01d29e4e18f334d16f02a2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2442 Malicious code in dependencyconfusioncve2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99a26d12e87e1df9f320758a4d87d8db3276c26017deb168e0a860275fd85d1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2018 Malicious code in colors-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1a2be90808c617991eb669e9364f06062821c574cc880e9ec10c6467383aa0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5116 Malicious code in orangeonion.buildtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01d5d87d4e17da3a852029e3970ff209b44f9254cf8481c4a527feb52b18524a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4847 Malicious code in nginxconfig.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 400e870471def5cb533f443425f9af880d3f5df7783baba1b0ea3f8b22343abc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4564 Malicious code in mes-bah (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 711fc50ffab5cdf3d8c553d2254216d5eb19a0fce4139d63949183ab0fd8527c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4445 Malicious code in mad-expo-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b6c233978f8ced2a4470f669433a149ad554d58778e96f615d0dfbc7275c9f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2927 Malicious code in express-lastest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c78f4997e4b378d63d24061f7eba2438ea82aec52c6b7f1860c3c2de9beeaed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1507 Malicious code in bernie-abacus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51dd3fec2ffe9da46544acc21edd1c8c93b4daac7ae2e59e87734804884800c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5070 Malicious code in oms-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fc10a735991e54e1553bcd8bc1c4041ec2456c5e47cc64291bd5ea3931e5c2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-394 Malicious code in @logistics-frontend/modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4cfb4ef58af701fde6a6535d9f669a870e7ef44606fb659eba4368fb835340a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...