allstar

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

PcapPlusPlus

PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. PcapPlusPlus enables decoding and forging capabilities for a large variety of network protocols. It also provides easy to use C++ wrappers...

criticality_score

Open Source Project Criticality Score Beta This project is maintained by members of the Securing Critical Projects WG. Goals 1. Generate a criticality score for every open source project. 2. Create a list of critical projects that the open source community depends on. 3. Use this data to...

scorecard

OpenSSF Scorecard Aperçu Qu'est-ce que Scorecard ? Utilisateurs notables de Scorecard Consulter le score d'un projet Données publiques de Scorecard Utilisation de Scorecard Action GitHub Scorecard API REST Scorecard Badges Scorecard Interface en ligne de commande Scorecard Prérequis Installation...

guac

GUAC : Graphe pour la compréhension de la composition des artefacts Remarque : GUAC est en cours de développement actif – si vous souhaitez contribuer, veuillez consulter le guide du contributeur. GUAC est un projet en incubation de l'OpenSSF sous l'égide du Supply Chain Integrity WG. Graph for...

slsa

SLSA « salsa » est Supply-chain Levels for Software Artifacts SLSA prononcé "salsa" est un cadre de sécurité de la source au service, offrant à toute personne travaillant avec des logiciels un langage commun pour augmenter les niveaux de sécurité logicielle et d'intégrité de la chaîne...

allstar

Allstar !IMPORTANT L'application GitHub Allstar hébergée par l'OpenSSF a été retirée. Allstar, le sous-projet OpenSSF Scorecard, continue quant à lui d'être maintenu — vous devez désormais l'exécuter vous-même, soit en tant qu'action GitHub, soit en tant que démon de service. Voir ossf/allstar881...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

SecureML

SecureAIML 🔐 Enterprise-Ready AI Model Security built on OpenSSF Model Signing SecureAIML is the "Stripe for model security" - making enterprise-grade AI model protection accessible, user-friendly, and production-ready for every organization. Why SecureAIML? In the era of AI/ML, model security is...

Nest

!Issueshttps://img.shields.io/github/issues/owasp/nest?color=blue&style=...

Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

MAL-2026-16162 Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

Malicious code in oce-configurator-wireless-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191e4a78bf46781b56b290aac7b804fd9470b1ac189896b950afbaba548183e6 Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The...

MAL-2026-15940 Malicious code in oce-configurator-wireless-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191e4a78bf46781b56b290aac7b804fd9470b1ac189896b950afbaba548183e6 Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The...

Malicious code in omni-channel-order-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal omni-channel-order-frontend package...

Malicious code in ocfe-tv-subscription-center-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b1dcb639402e9d94a5f6f171e32ed97eb7064f7a557b1f7382bf832a4415ba Package name resembles an internal-scoped name and uses an implausibly high version 9999.0.0 consistent with dependency-confusion targeting. The...

MAL-2026-15939 Malicious code in omni-channel-oid-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on npm install. The script collects os.hostname,...

MAL-2026-15909 Malicious code in 1nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43 Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js...

Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...