MAL-2024-1052 Malicious code in relativity-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ceec81f16c03da2474b6b582560b0fc3bd20fa136bb49dadead29fc397209f70 The OpenSSF Package Analysis project identified 'relativity-web-component' @ 2.999.0 npm as malicious. It is considered malicious because: - The...

Malicious code in astar-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9c7d3b2f90649e2315bacb152ef9917066857fd46b3240dca8dfa09ae075df60 The OpenSSF Package Analysis project identified 'astar-e2e-tests' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in i18next-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4e71c3a73449651c3bbbef4cc540bb5df6e12736e304e95a5a64f2c0c9f55189 The OpenSSF Package Analysis project identified 'i18next-ext' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8062 Malicious code in zara-mkt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63035f09a78f784aa3cc30ea29d7a7508c1811c6f344d00b42e93338f2cb50c5 The OpenSSF Package Analysis project identified 'zara-mkt-core' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in puppet-module-posix-system-r (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ad3a13f7c087320a9f4bf76203fd40172a2b55172dec3ac957ad4d265c01425 The OpenSSF Package Analysis project identified 'puppet-module-posix-system-r' @ 1.0.0 rubygems as malicious. It is considered malicious because...

Malicious code in eslint-plugin-indeed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cd3cf0dfdda3ea0bf705d385efb05c56b971a408c4a0dceef3771d2e474a33e0 The OpenSSF Package Analysis project identified 'eslint-plugin-indeed' @ 99.99.9 npm as malicious. It is considered malicious because: - The...

Malicious code in skyscanner-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4e80c6a572898c77cc6e5b4c0266cc4805778ec35102f514669accd32b0664f0 The OpenSSF Package Analysis project identified 'skyscanner-themes' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1424 Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537d9d482d3e99b2757022edbff8c81e9a9bd9bf73f272f10634d355c813e635 The OpenSSF Package Analysis project identified 'fluent-plugin-enhance-k8s-metadata' @ 5.0.1 rubygems as malicious. It is considered malicious...

MAL-2023-34 Malicious code in @chegg/wtai-upload-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed3e4233e6f2d188d7f2bab940bf8574017cf73a97b440daddc7f4e3176075a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ossf-scorecard:fuzz_parse_from_yaml: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4963146315202560 Project: ossf-scorecard Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsefromyaml Job Type: libfuzzerasanossf-scorecard Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000004a98bb7 Crash State: NULL Sanitizer: address...

ossf-scorecard:fuzz_parse_from_yaml: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5093275361214464 Project: ossf-scorecard Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsefromyaml Job Type: libfuzzerasanossf-scorecard Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

New Google Scorecards Tool Scans Open-Source Software for More Security Risks

Google has launched an updated version of Scorecards, its automated security tool that produces a "risk score" for open source initiatives, with improved checks and capabilities to make the data generated by the utility accessible for analysis. "With so much software today relying on open-source...