Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

Moxa MXView Security Vulnerability

Moxa MXView is Moxa's network management software for configuring, monitoring and diagnosing network devices in industrial Ethernet networks. A security vulnerability exists in Moxa MXView version 2.8. The vulnerability can be exploited by a remote attacker to read the private key file of the web...