hijagger

hijagger - ハイジャック可能なパッケージをパッケージレジストリからチェックする このツールは、NPM および Python Pypi レジストリ内のすべてのパッケージのすべてのメンテナーについて、未登録のドメインまたはそれらのドメイン上の未登録の MX レコードをチェックします。ドメインが未登録の場合、そのドメインを取得し、2 要素認証が有効になっていなければアカウントのパスワードリセットを開始できます。これにより、パッケージをハイジャックして、そのパッケージに対して任意の操作を行うことができます。...

tanstack-compromise-checker

tanstack-침해-검사기 개발자 머신, 저장소, CI 실행기에서 TanStack npm 공급망 공격의 지표를 탐지합니다. Bash 스크립트, Docker 이미지, GitHub Action — 동일한 엔진, 세 가지 진입점. CVE-2026-45321 /GHSA-g7cv-rxg3-hmpx 2026년 5월 11일, 공격자는 GitHub Actions 캐시 중독을 통해 42개의 @tanstack/ 패키지에 걸쳐 84개의 악성 버전을 게시했습니다. 페이로드는 GitHub 토큰, npm 토큰, AWS/GCP/Azure 자격 증명을...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

Malicious code in guras-nitroacer-teajaw (npm)

Source: amazon-inspector 000ab5e1dc60fc8d5ecc2e747a2c89ed86f2b066c74e2f83ecd1b85c674725fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview @umschool/platform is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

Malicious Package

Overview @haimiya/baileys is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

Malicious Package

Overview tailwind-aspect-styles is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances o...

Malicious Package

Overview @yongot/canary-mcp-isolation is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious...

Malicious Package

Overview @usemosaik/template-react-js is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious...

Malicious Package

Overview @fyxzpediaa/baileys is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of t...

Malicious Package

Overview @vallensofficial/baileys is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances...

Malicious Package

Overview dbt-language-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview i18nexus-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview kiki-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview krdpass-auth-react-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @caliperx2/components (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

Malicious code in dying_shrimp_z3n (npm)

Source: amazon-inspector c827781b3609436b27d29d306741bd52db2fe59758fef8d512e7585f455f8e5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Embedded Malicious Code

Overview bmc-i18n-extract-cli is a 这是一款能够自动将代码里的中文转成i18n国际化标记的命令行工具。当然，你也可以用它实现将中文语言包自动翻译成其他语言。适用于vue2、vue3和react Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by...

Embedded Malicious Code

Overview feishu-docx-mcp is a Model Context Protocol server for Feishu integration Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published...

Malicious Package

Overview wallet-cds-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...