CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

MAL-2023-8370 Malicious code in tencent-cloud-python-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security bf236cca18e4d157a57cd3de7abed8ad967103c42b9ae53f5026174af46b64a4 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8362 Malicious code in python-alibabacloud-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1384f0a4ed6515eb7e720621346f74f53217b73863f4c5e3cda4fc90b52f49e3 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8359 Malicious code in aws-enumerate-iam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96d7eea455989a7a10bf2fafd9f9c4a2d5d9a4c2a3ec852e424885f3e51c5edb Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8361 Malicious code in enumerate-iam-aws (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46f8fde812a7274ad1e270e0cc3a8698349365af5d85ee9b89248fa467e5bf2f Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8355 Malicious code in alisdkcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 456242a426a17eeaca869a5f00ee2f02d837dec5bba7da9240b6bec77c0ae8a8 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8363 Malicious code in python-alibabacloud-tea-openapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8310 Malicious code in cephlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f82a5ba62b790856947d686397170162bf743b168fd9d66008ed6501b465d5af The OpenSSF Package Analysis project identified 'cephlib' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8309 Malicious code in xmlbuilder3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5ccc40a08ace658e1c2bb67a692e4a04f1c6c826a6cfbf7c2bec41d0f54c540 The OpenSSF Package Analysis project identified 'xmlbuilder3' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8308 Malicious code in nnabla-ext-cuda101-nccl2-ubuntu16 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 70047d0a5eb542220386cc3c3f7f8bd4bee3faa63ce2124f363abcc1503be3df The OpenSSF Package Analysis project identified 'nnabla-ext-cuda101-nccl2-ubuntu16' @ 0.0.2 pypi as malicious. It is considered malicious becaus...

MAL-2023-8307 Malicious code in narratives-from-tweets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1570135eff60eea1dfd9ec7b66797d9454373263050b83c8ad90d2b7b37d71b6 The OpenSSF Package Analysis project identified 'narratives-from-tweets' @ 0.1 pypi as malicious. It is considered malicious because: - The...

MAL-2023-8306 Malicious code in liblapack-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 01a9f7fec70ee10cd7862c22e2c8257811997655e86e342b7bf61d0bd2b95154 The OpenSSF Package Analysis project identified 'liblapack-dev' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8304 Malicious code in libblas3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce6c63048cc523093131cc1ce9bdc1581093b52f97225581ea78fef61404e8a The OpenSSF Package Analysis project identified 'libblas3' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in libblas3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce6c63048cc523093131cc1ce9bdc1581093b52f97225581ea78fef61404e8a The OpenSSF Package Analysis project identified 'libblas3' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8305 Malicious code in liblapack3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74012077041418bce1aed1339b95d0221435cff33db310194f29d9a0c2451e6e The OpenSSF Package Analysis project identified 'liblapack3' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8570 Malicious code in pyefflorer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9db59fb1fff1df375feb9a17164f004b62a2d5fa194dcc285341536b6bfb51aa Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8290 Malicious code in poc-nvk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10eb10880328aea55a7c7620d283f145ebcb574bfc98567eef9ad44d1ee8fcdb The OpenSSF Package Analysis project identified 'poc-nvk' @ 0.1.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8573 Malicious code in pyhulul (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f22a13d592f8a4de9eaf39b1c4c0c149232890e90dc5cff2988d49901d31a3e2 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8575 Malicious code in pyioler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b5a0ae31e85484643163bd7b0da8800b531141a1e5d14a97f534b2bfdbefb531 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions

A new deceptive campaign has been observed hijacking GitHub accounts and committing malicious code disguised as Dependabot contributions with an aim to steal passwords from developers. "The malicious code exfiltrates the GitHub project's defined secrets to a malicious C2 server and modify any...