MAL-2024-7439 Malicious code in sap-access (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1aa14a85de6a25c0c6ad3c4e767a216f5abbd057f79e6b296168df122fe6d7eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fake-package-agpl-license (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 53470e96107ebc806b1a440821244a335389aca112b5752ce995ae87150b0b4d The OpenSSF Package Analysis project identified 'fake-package-agpl-license' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-7091 Malicious code in parser-7.0.0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 99ace32a9b913ac4a00ad574ac934c4eb6274d7c0cf3b948ced6b8191f511b68 The OpenSSF Package Analysis project identified 'parser-7.0.0' @ 4.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-36257 Lack of permission check when updating the profile picture of a remote user (shared channels enabled)

Mattermost versions 9.5.x = 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious...

Malicious code in iobeya-time-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b5b2fd0fb985e16671bbfe20f9b7b2ef8e7a62cc0050b51cea290d85574f75c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1661 Malicious code in govgen-governance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3df1a5ba7e5302cde15d6c6ab8220b80b3dd7d291cbdab4f06cac278dacf77de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in trip-component-platform-online-region-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 007878676d8487bbeba763b564d225daf11ed353d8624a1aa8e52264efe40497 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1650 Malicious code in trip-component-platform-online-region-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 007878676d8487bbeba763b564d225daf11ed353d8624a1aa8e52264efe40497 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1651 Malicious code in webquickauth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e838cec17c1006b567e2a70f9554fd2a040c9fb0cfdf8d753e81548c1ea02c49 The OpenSSF Package Analysis project identified 'webquickauth' @ 2.3.5 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-1643 Malicious code in quickwebbasicauth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e8ebea7be43f522c7fd45c4793bcac3b33c5ffafa2dc9ea3e0f28657bc650819 The OpenSSF Package Analysis project identified 'quickwebbasicauth' @ 2.3.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-1631 Malicious code in draconianspeed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b1212e40bb57fce7672f50431153645b13624cc1e2061b44c0b91fec275e7853 The OpenSSF Package Analysis project identified 'draconianspeed' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1624 Malicious code in importlib-metadate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b6db8994d6a78a5d0d95df2d0add2257ee6188f8c5419cbd7e2813426739d15d --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: baidu-readver Reasons based on the campaign: - The package...

MAL-2024-1588 Malicious code in leocare-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 311899bcdd83d3cd308268641290fc8fd0f503d308fc1bbf7488b5f0fab734cb The OpenSSF Package Analysis project identified 'leocare-new' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1614 Malicious code in braintree-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 317e40dddb16cb1cb057d35c6fecd763482fcff6009f8fb06386f4b526cb3b10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1615 Malicious code in braintree-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ba47f404b8012a3baa206a37fd59066ff35442cb95da8ba7bd1b44a6b9a7968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-JCQQ-G64V-GCM7 Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX

Impact Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier but not the latest ATX as previous break...

MAL-2024-1331 Malicious code in roblox.lua (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e40a28a758bd57252f74153dd5b2a9b6358608bfa2ec08c301e3647a7721e35a The OpenSSF Package Analysis project identified 'roblox.lua' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1330 Malicious code in elk-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaece47ca73a2646b0cb728b7816026ec3135f48e18054950dce89f8bf9073b0 The OpenSSF Package Analysis project identified 'elk-uikit' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execut...

MAL-2024-1308 Malicious code in not-exist-lykos-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a4ae62646ef95a3157dcd61e8c0f58a25bec2c826d45f514c6e7bffde0126d4 The OpenSSF Package Analysis project identified 'not-exist-lykos-poc' @ 66.6.6 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-1275 Malicious code in @portal-packages/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 543a89535f49dbd2c40707219fba6c80040d752e90ba3347abf1d61e9ea0e477 The OpenSSF Package Analysis project identified '@portal-packages/utils' @ 3.0.99 npm as malicious. It is considered malicious because: - The...