Malicious code in keypair-decryptor-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28b7a13ea11bbb26ce1785b3784f6dcd3470a60ad16e2235d40089c17023e8e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4689 Malicious code in keypair-decryptor-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28b7a13ea11bbb26ce1785b3784f6dcd3470a60ad16e2235d40089c17023e8e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4092 Malicious code in keypair-encrypt-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a2d0ae49bf40dbf55ae8f036a2014dccfa4ad0194cebdc787acbfb69658df40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-encrypt-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a2d0ae49bf40dbf55ae8f036a2014dccfa4ad0194cebdc787acbfb69658df40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-utilsee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2a2d11e5c7234bf618c7909f22af17e0fd3787ec6e461114dfaca49fd2ef108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4093 Malicious code in keypair-utilsee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2a2d11e5c7234bf618c7909f22af17e0fd3787ec6e461114dfaca49fd2ef108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-encrypt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dba96628edf26ee562bf2ef714531b6dbcd101c8a997a95d3fa94673be4754c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3791 Malicious code in keypair-encrypt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dba96628edf26ee562bf2ef714531b6dbcd101c8a997a95d3fa94673be4754c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-encryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02f1145632762977fc8763c9f6ee3f5c9272b45196357654217a1bc1ce13bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3297 Malicious code in keypair-encryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02f1145632762977fc8763c9f6ee3f5c9272b45196357654217a1bc1ce13bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 568ba985579400ab47e546c13e36f6e7d3ff6e81d4411918b10eee2f384b349c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3027 Malicious code in keypair-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 568ba985579400ab47e546c13e36f6e7d3ff6e81d4411918b10eee2f384b349c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2573 Malicious code in keypair-encryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1265d869c665e7bb42b4827bc9f51ad572b2ce181edebfc84eeb5698e0e39048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-encryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1265d869c665e7bb42b4827bc9f51ad572b2ce181edebfc84eeb5698e0e39048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29186

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the idrsa.pub public key of the keypair was copied to authorizedkeys files on remote host, those hosts...

MAL-2024-11763 Malicious code in keypair-layout-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14dcde51dd210ea29065e53961174252e1e089b897e7470b76239c5b45799eff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-layout-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14dcde51dd210ea29065e53961174252e1e089b897e7470b76239c5b45799eff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-41948

The CVE affects biscuit-java, the Java implementation of Biscuit tokens used for microservices authentication/authorization. A vulnerability exists in the handling of ThirdPartyBlock requests: a malicious user can forge a ThirdPartyBlockRequest and alter the publicKeys field, allowing an attacker...

CVE-2024-41948 biscuit-java vulnerable to public key confusion in third party block

biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...