608 matches found
Malicious code in elf-stats-merry-chimney-765 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0435e21ddce3b9d114ac17bbe0bcb5977f29f67aed49768c7273851c2f70b703 The package elf-stats-merry-chimney-765 was found to contain malicious code...
EUVD-2025-200932
Malicious code in elf-stats-evergreen-bow-653 npm...
MAL-2025-192124 Malicious code in elf-stats-rooftop-hammer-580 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00f8e0b61802c2ebee9fe5ddb54aee5ab39d5cd53e658b235a4543c99e91e383 The package elf-stats-rooftop-hammer-580 was found to contain malicious code. Source: ghsa-malware...
A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software
Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...
S3C2 SICP Summit 2025-06: Vulnerability Response Summit
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US and EU governments and industry are equally interested in enhancing software security, including supply chain and...
Exploring the SECURITY.Md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem
Security policies, such as SECURITY.md files, are now common in open-source projects. They help guide responsible vulnerability reporting and build trust among users and contributors. Despite their growing use, it is still unclear how these policies influence the structure and evolution of softwa...
Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems
Shai-hulud 2.0 campaign features a sophisticated variant capable of stealing credentials and secrets from major cloud platforms and developer services, while automating the backdooring of NPM packages maintained by victims. Its advanced tactics enable rapid, stealthy propagation across the softwa...
A Reality Check on SBOM-Based Vulnerability Management: An Empirical Study and a Path Forward
The Software Bill of Materials SBOM is a critical tool for securing the software supply chain SSC, but its practical utility is undermined by inaccuracies in both its generation and its application in vulnerability scanning. This paper presents a large-scale empirical study on 2,414 open-source...
EUVD-2025-199323
Malicious code in @everreal/react-charts npm...
EUVD-2025-199022
Malicious code in template-lib npm...
EUVD-2025-198331
Malicious code in @ra-ftds/ra-flourish-design-tokens npm...
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Cyberattacks are becoming increasingly frequent and sophisticated, often exploiting the software supply chain SSC as an attack vector. Attack graphs provide a detailed representation of the sequence of events and vulnerabilities that could lead to a successful security breach in a system. MulVal ...
EUVD-2025-180020
Malicious code in blueshift-exoplanet-buffer-primatology npm...
EUVD-2025-177966
Malicious code in magnetosphere-quito-isostasy-despina npm...
EUVD-2025-175427
Malicious code in zenobia-colors-neptunology-darkmatter npm...
EUVD-2025-178583
Malicious code in hawkingradiation-xenobiology-prettier-stylelint-buffer npm...
EUVD-2025-138044
Malicious code in flights-inlutag-iduliabisa npm...
EUVD-2025-138139
Malicious code in avangs-olium-nilvaint npm...