Supply-Chain

Segurança na Cadeia de Suprimentos de Software Uma série abrangente de três livros sobre segurança na cadeia de suprimentos de software, cobrindo ameaças, defesas e governança. Este manuscrito de código aberto fornece a profissionais de segurança, desenvolvedores e líderes organizacionais...

aura

यह रिपॉजिटरी एक नए स्थान पर स्थानांतरित हो गया है: https://github.com/SourceCode-AI/aura सुरक्षा ऑडिटिंग और कोड इंट्रोस्पेक्शन समस्या के बारे में विकास में वर्तमान प्रवृत्ति विकास चरण में बहुत सारे पैकेजों का उपयोग करने की है, भले ही वे केवल तुच्छ कार्यक्षमता प्रदान करते हों और 11 पंक्तियों के को...

packj

Packj يُعلّم عن الحزم مفتوحة المصدر الخبيثة/الخطيرة Packj تُنطق package هي أداة للمساعدة في تخفيف هجمات سلسلة توريد البرمجيات. يمكنها اكتشاف الحزم الخبيثة، الضعيفة، المهجورة، ذات الأسماء المتشابهة typo-squatting، وغيرها من الحزم "الخطيرة" من سجلات الحزم مفتوحة المصدر الشهيرة، مثل NPM وRubyGems...

msidump

msidump MSI Dump - uma ferramenta que analisa pacotes MSI maliciosos, extrai arquivos, streams, dados binários e incorpora um scanner YARA. Em documentos do Office habilitados para macro, podemos usar rapidamente oletools mraptor para determinar se o documento é malicioso. Se quisermos dissecá-lo...

cisco_asa_research

Recherche sur Cisco ASA Ce dépôt contient les diapositives et le code présentés à Black Hat USA 2022 et à la DEF CON 30. Vous y trouverez : Diapositives Les decks de diapositives de la DEF CON 30 et de Black Hat. Le deck de la DEF CON est légèrement plus long en raison d'un créneau horaire plus...

depx

depx दुर्भावनापूर्ण पैकेज और आपूर्ति-श्रृंखला खुफिया विशेषताएँ • स्थापना • उपयोग • depx चलाना • JSON • Discord से जुड़ें...

ore-mal-pkg-inspector

OreWatch Scanner de Deteção de Pacotes Maliciosos Multi-Ecossistema e Segurança na Cadeia de Suprimentos Uma ferramenta de segurança de nível de produção para detetar pacotes maliciosos e ameaças à cadeia de suprimentos nos ecossistemas npm, PyPI, Maven, RubyGems, Go e Cargo. Utiliza recolha...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package...

Malicious Package

Overview npmjstruffle-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Embedded Malicious Code

Overview @builder.io/dev-tools is a Builder.io Visual CMS Devtools Affected versions of this package are vulnerable to Embedded Malicious Code. The affected version contains malicious code, and its content was removed from the official package manager. While this package might be attempting to...