Malicious code in dependencykfee-2 (npm)

Source: ossf-package-analysis bb75f6ebc23c1e1ea6fc3ae422db80b65e8f9b8d7c21faa2de9c58ba049e9d89 The OpenSSF Package Analysis project identified 'dependencykfee-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in atlassian-wallboard-plugin (npm)

Source: ossf-package-analysis 65fa335403aab4ce396a9df1a2b0d61634f51ee8d63db761c0ccf21f744b6292 The OpenSSF Package Analysis project identified 'atlassian-wallboard-plugin' @ 10.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...

Malicious code in claims-acct-unlock (npm)

Source: ossf-package-analysis 49e97601227bdd6c1f90001323f6ec7ec7242416e3577d752dd5045453688a14 The OpenSSF Package Analysis project identified 'claims-acct-unlock' @ 25.2.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in siren-lament (npm)

Source: amazon-inspector 66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8 The package contains two files and declares no lifecycle scripts, remote fetches, credential reads, or network exfiltration paths. Version coordinate 0.0.0-stage and minimal file count are consistent with a...

Malicious code in black-spindle (npm)

Source: ossf-package-analysis c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab The OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

All-In-One: A Composable Attack on LLM Transformations

Quantization, pruning, and model merging are popular transformations applied to deployment-ready LLMs to improve efficiency and downstream performance. Recent work has shown that these transformations can introduce a security threat: an adversary can train a model that passes safety checks in its...

Malicious code in @flexmr/utils (npm)

Source: ossf-package-analysis fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4 The OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in @flexmr/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52 @flexmr/[email protected] ships a one-line re-export stub whose package.json declares its sole dependency daemon-thread-lookup-buffer via a direct HTTPS U...

Runaway Reaction: When Benign Skills Compose into Malicious Behavior

Agent skills package task-specific knowledge and procedures that can be composed to support complex agent tasks, while public marketplaces provide a growing pool of reusable skills. Existing security vetting, however, largely evaluates skills in isolation, leaving composition-induced risks...

Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

Malicious code in wurl_show_data (RubyGems)

Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The package executes one or more commands associated with maliciou...

Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

Source: ossf-package-analysis 278821d7a9d245a4193d8536c0b127f61cf1b13335dfe91abaefece6b908a57e The OpenSSF Package Analysis project identified '@asdfaskdjfksadhfkasf/nadaver2' @ 102.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in lc-config (npm)

Source: ossf-package-analysis d918d66169ac2696569bb389d82b0b95640986fdc77ab8cec9639908d156d0c5 The OpenSSF Package Analysis project identified 'lc-config' @ 5.5.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - T...

Malicious code in kubernetes.io (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 00f207ddd7d4909824d1a01b502b9d29b27380e31b9b410162ed5381de2fae41 The OpenSSF Package Analysis project identified 'kubernetes.io' @ 1.0.0 npm as malicious. It is considered malicious because: -...

Malicious code in kobi--front-helpers (npm)

Source: ossf-package-analysis 5177d79e84b460a9e6e01e3f7ec740846cab3ff8094ccf7fa38232683498d45c The OpenSSF Package Analysis project identified 'kobi--front-helpers' @ 1.15.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in kkrfunds (npm)

Source: ossf-package-analysis 74bb5d7b33431c1009ea3297276e5033a7a4b29132c38f97d0a2ed19a5bf6061 The OpenSSF Package Analysis project identified 'kkrfunds' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...

Malicious code in keycloak-server (npm)

Source: ossf-package-analysis 3df989aa26dccceca3917c9b3454427df4f54e9c104fbc080e913d30af3e66b2 The OpenSSF Package Analysis project identified 'keycloak-server' @ 0.0.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in k0m3g4-test (npm)

Source: ossf-package-analysis bd260efc78494efc57d67f6576d7ae30b8e58e866ee7a3c228692548174c1e19 The OpenSSF Package Analysis project identified 'k0m3g4-test' @ 2.999.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in justeat-storybook (npm)

Source: ossf-package-analysis 577d8ffd11e5da3a5000b8a390c45c8474d2dd362e509a65a107f2b0df13e563 The OpenSSF Package Analysis project identified 'justeat-storybook' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...