GhostAction Attack Steals 3,325 Secrets from GitHub Projects

GhostAction supply chain attack hit 817 GitHub repositories, stealing 3,325 secrets including npm, PyPI, and DockerHub tokens...

CVE-2021-32724

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...

Malicious code in keccak-crypto (npm)

This package is a starjacking attack which bundles a cryptostealing payload. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ded491472e4703368974a54f37663b29332b6a969e3e8fa8ccefec26d5b4c8a0 Any computer that has this package installed or running should be considered...

MAL-2024-9216 Malicious code in blockpi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd90ac1ab38adb471705c02da1ac6a2113755a7e00e9851597a6b5226bbf075a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Prefect Cross-Site Request Forgery Vulnerability

Prefect is a workflow orchestration tool that enables developers to build, observe, and react to data pipelines. Prefect suffers from a cross-site request forgery vulnerability that originates from allowing an attacker to steal secrets and execute remote code via cross-site request forgery CSRF...

This Cryptomining Tool Is Stealing Secrets

Plus: Details emerge of a US government social media-scanning tool that flags “derogatory” speech, and researchers find vulnerabilities in the global mobile communications network...

MAL-2023-7930 Malicious code in bspin.mobilecasino (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 65f32001f04a5f4b6e32fe438de1f89d70b3873bd38c8eac28761d78900b0ce0 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-8032 Malicious code in olymptrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 980d1b05adbe09f084ff3a74bbcdf8e7b12c80d99842d8caf74bb22009af6e38 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-7939 Malicious code in orbitplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx df1bde52050b0c84fcf4221afb1f77445edcbfc7e307f2eaf54fb104ce916f06 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-7931 Malicious code in career-service-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d053ab0c6c3eb4184d3e98ecd922d23cc351f70a7df8a410d1271644721481ac Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-8031 Malicious code in ng-zulutrade-ssr (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b7f6b1d4585de70357f4ac94823e53c6846ebaeaf161d5088e75c3fde5f7ac05 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in zip_achive_bp (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a268db221b575c75e97a65f2a00d56b0a4ac4d14910e381fa972bf522479022f Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test521 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 166bebecf34acabc1fdf3c66906bda21b7b7e7043f76cf728dd8637270162021 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test525 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 801d93e817d2a88be92c4ce8b23fb15ec2a02dba59eea3666d03eee45d2dd072 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test527 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 873572cb006dd8216d097e1014bc26f4f54e2e57b00c4ed5db617993287c9735 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test532 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f05f5aa40e4c7abb13accb6085899f4b3fdf227cad5d43b4066b5a7d73717243 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test528 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 97568f0e3334d6f7383a27c82a79b1e1be7654b988294006c30290011d105e55 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in kiwi_vicious (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 24d3a7f0211bfcde4618961d390577b0a47d7aab36c363af84243b2427fc1c51 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in some_crucial_web_app_new (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ccdfaaee4aea58e70c939bbfb4ebf1b0e2bf0cd4ce9918422a25e37c7ac59071 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in pear_vile (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 145f67c3ae87aa203e53f5a36d076c01ad4a8b9bc5cc89d0b6c13a4a9b73999e Malicious packages campaign since 2021 targeting developers, steals source code and secrets...