MAL-2026-14310 Malicious code in bunnyhijack-test-0x00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value due to the protocDigest parameter being ignored when the protoc executable is sourced from the system PATH. An attacker can bypass integrity verification by placing a malicious protoc binary...

GHSA-J2PC-V64R-MV4F Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

Summary The expected protocDigest is ignored when protoc is taken from the PATH. Details The documentation for the protocDigest parameter says: ... Users may wish to specify this if using a PATH-based binary ... However, when specifying PATH the protocDigest is not actually checked because the co...

Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

Summary The expected protocDigest is ignored when protoc is taken from the PATH. Details The documentation for the protocDigest parameter says: ... Users may wish to specify this if using a PATH-based binary ... However, when specifying PATH the protocDigest is not actually checked because the co...

[SECURITY] Fedora 42 Update: rust-protobuf-parse-3.7.2-1.fc42

Parse .proto files. Files are parsed into a protobuf::descriptor::FileDescriptorSet object using either: pure rust parser no dependencies protoc binary more reliable and compatible with Google's implementation...

[SECURITY] Fedora 42 Update: rust-protobuf-codegen-3.7.2-1.fc42

Code generator for rust-protobuf. Includes a library to invoke programmatically e. g. from build.rs and protoc-gen-rs binary...

[SECURITY] Fedora 43 Update: rust-protobuf-parse-3.7.2-1.fc43

Parse .proto files. Files are parsed into a protobuf::descriptor::FileDescriptorSet object using either: pure rust parser no dependencies protoc binary more reliable and compatible with Google's implementation...

[SECURITY] Fedora 43 Update: rust-protobuf-codegen-3.7.2-1.fc43

Code generator for rust-protobuf. Includes a library to invoke programmatically e. g. from build.rs and protoc-gen-rs binary...

[SECURITY] Fedora 41 Update: rust-protobuf-codegen-3.7.2-1.fc41

Code generator for rust-protobuf. Includes a library to invoke programmatically e. g. from build.rs and protoc-gen-rs binary...

[SECURITY] Fedora 41 Update: rust-protobuf-parse-3.7.2-1.fc41

Parse .proto files. Files are parsed into a protobuf::descriptor::FileDescriptorSet object using either: pure rust parser no dependencies protoc binary more reliable and compatible with Google's implementation...

Malware in zora1abs-protoc-helper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in zora1abs-protoc-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32798df02edd137f9c9492f0b336887efd45c7af6f15e4bac809b1e107d7b4bd Any computer that has this package installed or running should be considered...

MAL-2025-4965 Malicious code in zora1abs-protoc-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32798df02edd137f9c9492f0b336887efd45c7af6f15e4bac809b1e107d7b4bd Any computer that has this package installed or running should be considered...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, flux, q, actions-runner-controller, cfssl, k3s, src, kaf, nri-discovery-kubernetes, php-fpmexporter, kube-logging-operator, ctop, kubernetes-dashboard-metrics-scraper, render-template, vexctl, direnv, capslock, aws-flb-kinesis, metall...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, flux, q, actions-runner-controller, cfssl, k3s, src, kaf, nri-discovery-kubernetes, php-fpmexporter, kube-logging-operator, ctop, kubernetes-dashboard-metrics-scraper, render-template, vexctl, direnv, capslock, aws-flb-kinesis, metall...

GHSA-3WHM-J4XM-RV8X vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, minify, php-fpmexporter, whereabouts, step-ca, crossplane-provider-aws-lambda, dagdotdev, kubernetes-dashboard-metrics-scraper, capslock, trivy, cloudflared, spqr, sqlexporter, bank-vaults, argo-rollouts, fulcio, gitness, restic,...

Malicious code in protoc (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10107 Malicious code in protoc (PyPI)

--- -= Per source details. Do not edit below this line.=-...

protoc-gen-validate:FuzzTest: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5192249485885440 Project: protoc-gen-validate Fuzzing Engine: libFuzzer Fuzz Target: FuzzTest Job Type: libfuzzerasanprotoc-gen-validate Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: NULL Sanitizer:...

[SECURITY] Fedora 36 Update: protobuf-c-1.4.1-2.fc36

Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. This package provides a code generator and run-time libraries to use Protocol Buffers from pure C not C++. It uses a modified version of protoc called protoc-c...