MAL-2022-4780 Malicious code in nab-packages-react-utils-nab (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8120362995adcf1dfb405249ecc06115b8f7bd48d9d3a2e81c3b601830d66c9e Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Malicious code in reequests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 527aece3e73d2bd7e861a39485ce31dd5c649c35088b9787fad7479fbb634231 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

Malicious code in reqquests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b9a54f366ac9633e5aee64e1efffcdcfb633b5b78922b33ceb6e32ce7d64ca51 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2022-7438 Malicious code in requessts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 281d687d37b55f2d202f7ae0a8b421b286a71ebd2992bf7608ebe030ec6f8e53 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2022-7439 Malicious code in requestts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0c0ffc8f86c690c110698019cf875b931478cfd7c059ea4da99532950ae57829 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2022-7440 Malicious code in requuests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx add900896883e60604145a44ada9b8e7fb1013ea91ee1b719b7b3e26a94824ae Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2022-7435 Malicious code in reqquests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b9a54f366ac9633e5aee64e1efffcdcfb633b5b78922b33ceb6e32ce7d64ca51 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

Malicious code in reuests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8595aba5fb09b2fb54831d18452e4a1980daf222f8ea4d62b50d29446419c309 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2022-7441 Malicious code in reuests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8595aba5fb09b2fb54831d18452e4a1980daf222f8ea4d62b50d29446419c309 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2022-7434 Malicious code in reequests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 527aece3e73d2bd7e861a39485ce31dd5c649c35088b9787fad7479fbb634231 Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

RubyGems 安全漏洞

RubyGems is a Ruby package manager from the Rubygems organization. The product is primarily used to distribute and manage Ruby packages. RubyGems suffers from a security vulnerability that stems from a sorting error in gem upload code, where certain gems are temporarily replaced by malicious...

Malicious NPM Packages Target German Companies in Supply Chain Attack

Cybersecurity researchers have discovered a number of malicious packages in the NPM registry specifically targeting a number of prominent media, logistics, and industrial firms based in Germany to carry out supply chain attacks. "Compared with most malware found in the NPM repository, this payloa...

A scanning tool for open-sourced software packages? Yes, please!

The Open Source Security Foundation OpenSSF, a collective of industry leaders aimed at improving the security of open-source software OSS, recently announced the release of a prototype tool that scans for malicious packages in open source repositories. This tool, conveniently called Package...

Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation OpenSSF has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packag...

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages

A "logical flaw" has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them. The supply chain threat has been dubbed "Package...

Red Lion DA50N 数据伪造问题漏洞

The Red Lion DA50N is a series of secure edge network gateways from Red Lion, U.S.A. The Red Lion DA50N is vulnerable to a data forgery issue that stems from the possibility that an authorized user could install a maliciously modified package file when updating the device via the Web UI, and that...

Malicious Packages

exchangeclients and rush-lib are malicious packages. The packages contains empty README files but the strings: "rukkaz package" or "azbit package" present in the metadata. The packages are created to abuse the dependency confusion vulnerability. The malicious code executes upon installation and...

Thousands of Malicious npm Packages Threaten Web Apps

More than 1,300 malicious packages have been identified in the most oft-downloaded JavaScript package repository used by developers, npm, in the last six months — a rapid increase that showcases how npm has become a launchpad for a range of nefarious activities. New research from open-source...

MAL-2022-7431 Malicious code in bootstrap-feature (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3db5e43a78e41f050b0e265c951bc776e693abd20a01108e6c8ea2e15a5e7c4d Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2021-4 Malicious code in lib-bb-html-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 74072bddc9908e0147976fde0680c197ac5b38167bfcdf14afc5f79f23749f72 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...