33 matches found
MAL-2026-14310 Malicious code in bunnyhijack-test-0x00 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...
Malicious code in test-pkg-x0 (npm)
Source: amazon-inspector 0d0014944456f668a25fa484bf7cb5f36a7128d6a585b86d9294d8d49b23049a Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branches on uname -s Darwin/MINGW/Linux and executes OS-native commands on the installer's...
Malicious code in protoc (PyPI)
--- Credit: OpenSSF source...
GHSA-J2PC-V64R-MV4F Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH
Summary The expected protocDigest is ignored when protoc is taken from the PATH. Details The documentation for the protocDigest parameter says: ... Users may wish to specify this if using a PATH-based binary ... However, when specifying PATH the protocDigest is not actually checked because the co...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value due to the protocDigest parameter being ignored when the protoc executable is sourced from the system PATH. An attacker can bypass integrity verification by placing a malicious protoc binary...
Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH
Summary The expected protocDigest is ignored when protoc is taken from the PATH. Details The documentation for the protocDigest parameter says: ... Users may wish to specify this if using a PATH-based binary ... However, when specifying PATH the protocDigest is not actually checked because the co...
[SECURITY] Fedora 42 Update: rust-protobuf-codegen-3.7.2-1.fc42
Code generator for rust-protobuf. Includes a library to invoke programmatically e. g. from build.rs and protoc-gen-rs binary...
[SECURITY] Fedora 42 Update: rust-protobuf-parse-3.7.2-1.fc42
Parse .proto files. Files are parsed into a protobuf::descriptor::FileDescriptorSet object using either: pure rust parser no dependencies protoc binary more reliable and compatible with Google's implementation...
[SECURITY] Fedora 43 Update: rust-protobuf-codegen-3.7.2-1.fc43
Code generator for rust-protobuf. Includes a library to invoke programmatically e. g. from build.rs and protoc-gen-rs binary...
[SECURITY] Fedora 43 Update: rust-protobuf-parse-3.7.2-1.fc43
Parse .proto files. Files are parsed into a protobuf::descriptor::FileDescriptorSet object using either: pure rust parser no dependencies protoc binary more reliable and compatible with Google's implementation...
[SECURITY] Fedora 41 Update: rust-protobuf-parse-3.7.2-1.fc41
Parse .proto files. Files are parsed into a protobuf::descriptor::FileDescriptorSet object using either: pure rust parser no dependencies protoc binary more reliable and compatible with Google's implementation...
[SECURITY] Fedora 41 Update: rust-protobuf-codegen-3.7.2-1.fc41
Code generator for rust-protobuf. Includes a library to invoke programmatically e. g. from build.rs and protoc-gen-rs binary...
Malware in zora1abs-protoc-helper
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-4965 Malicious code in zora1abs-protoc-helper (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32798df02edd137f9c9492f0b336887efd45c7af6f15e4bac809b1e107d7b4bd Any computer that has this package installed or running should be considered...
Malicious code in zora1abs-protoc-helper (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32798df02edd137f9c9492f0b336887efd45c7af6f15e4bac809b1e107d7b4bd Any computer that has this package installed or running should be considered...
GHSA-3WHM-J4XM-RV8X vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kinesis, neuvector-dbgen, paranoia, kubernetes-ingress-defaultbackend, trivy, yace, aws-load-balancer-controller, kuberlr, temporal, lazydocker, http-echo, crossplane-provider-aws-sqs, petname, cert-manager-webhook-pdns, opentelemetry-collecto...
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, pulumi-language-java, go-licenses, paranoia, cass-operator, kubevela, task, kind, nerdctl, aws-load-balancer-controller, cue, temporal, vt-cli, cadvisor, http-echo, petname, kubeflow-katib, kyverno-policy-reporter-kyverno-plugin,...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, pulumi-language-java, go-licenses, paranoia, cass-operator, kubevela, task, kind, nerdctl, aws-load-balancer-controller, cue, temporal, vt-cli, cadvisor, http-echo, petname, kubeflow-katib, kyverno-policy-reporter-kyverno-plugin,...