MAL-2023-1243 Malicious code in navigation-component-tco (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f783bdef910568f0931f880ce5329f8f4c71c869d64c8078374a3103dfe745e9 The OpenSSF Package Analysis project identified 'navigation-component-tco' @ 999.999.0 npm as malicious. It is considered malicious because: - T...

MAL-2023-369 Malicious code in fc-step (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0317a1a5c84c5f6b759548c4dd046ede64957e16bbe359b107db9b9ae30bb04c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-355 Malicious code in fc-lsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0200413ac00a1fc2a5171d583261c55a38be42242339fd265721f1fa8937bf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-333 Malicious code in fc-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77f6035edb9c1d932bd670b4ecd252c5ad1d38ae3ff39f0f2d3e68ca68a1d99f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-persoonlijke-pas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddadd77308256ef0411fae17ee4490cc470cd0234b284b8fe4b240e203586da4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eg-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccb389cade20271770197c32e90e23b603da814949522fa67b2230203ecd9b83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in javascript-appfabric-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f8b7cd0cdd29ede135536b1e9ca802d8bfd2343e149fb7fd4ff7de38a4d1813 The OpenSSF Package Analysis project identified 'javascript-appfabric-logger' @ 966.0.0 npm as malicious. It is considered malicious because: -...

MAL-2023-173 Malicious code in chartjs-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0694218023b99a066388095e0c9d8de4e8d09473cc88abac25165435e4a5d7d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1209 Malicious code in index-template-mets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 104f2ff9714322069aa6e619d7050de41349e85f4c3eaa04c4c25ba0e239e8a9 The OpenSSF Package Analysis project identified 'index-template-mets' @ 1.0.1 npm as malicious. It is considered malicious because: - The packag...

MAL-2023-1386 Malicious code in pandasprox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 09102fb6db10bc8a136ca7a902415e21c97a31cbf416c904a7efc49a10757320 The OpenSSF Package Analysis project identified 'pandasprox' @ 0.1.9 pypi as malicious. It is considered malicious because: - The package execut...

Malicious code in gkjzjh146 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2431c5b39467f95f9010ec4bdf29d10e4590cef754a0b41b3057c8a30551fe5 The OpenSSF Package Analysis project identified 'gkjzjh146' @ 1.3 pypi as malicious. It is considered malicious because: - The package executes...

MAL-2023-1365 Malicious code in gkjzjh146 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2431c5b39467f95f9010ec4bdf29d10e4590cef754a0b41b3057c8a30551fe5 The OpenSSF Package Analysis project identified 'gkjzjh146' @ 1.3 pypi as malicious. It is considered malicious because: - The package executes...

Threat Roundup for May 5 to May 12

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 5 and May 12. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

MAL-2023-1210 Malicious code in indoorviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d122f62071d7bd6fa6a2bf6fad646576aac0cb7826254901e07af309d40e2347 The OpenSSF Package Analysis project identified 'indoorviewer' @ 100.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1267 Malicious code in pmcrypto-v7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3a1eb09bba631f290225217047eab8997cef64f4c0e321d47728fc9ee46f6aa The OpenSSF Package Analysis project identified 'pmcrypto-v7' @ 8.999.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1268 Malicious code in pmcrypto-v7-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aa2e150fa7626c456fcd88a95dd114616578c8bf69b9cf9c772d3858a051b6ba The OpenSSF Package Analysis project identified 'pmcrypto-v7-test' @ 1.999.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1311 Malicious code in suncorp-styleguide-react-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b6a39ac171632a984b8ac8c3e53ab935e47753ac7e0df7161daa7bc23f8e08d The OpenSSF Package Analysis project identified 'suncorp-styleguide-react-components' @ 102.0.0 npm as malicious. It is considered malicious...

Malicious code in tempomati-omega-5-emcuf5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f86820db1cc72b3ab2076578417815de7e0bc83b54e954f68b41a7adf28dd66 The OpenSSF Package Analysis project identified 'tempomati-omega-5-emcuf5' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

Why Shadow APIs are More Dangerous than You Think

Shadow APIs are a growing risk for organizations of all sizes as they can mask malicious behavior and induce substantial data loss. For those that aren't familiar with the term, shadow APIs are a type of application programming interface API that isn't officially documented or supported. Contrary...

Threat Round up for February 17 to February 24

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Feb. 17 and Feb. 24. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...