dependency-track

OWASP Dependency-Track Dependency-Trackは、組織がソフトウェアサプライチェーンにおけるリスクを特定し軽減することを可能にする、インテリジェントなコンポーネント分析プラットフォームです。Dependency-Trackは、ソフトウェア部品表（SBOM）の機能を活用するという、独自で非常に有益なアプローチを採用しています。...

Supply-Chain

ソフトウェアサプライチェーンセキュリティ ソフトウェアサプライチェーンセキュリティに関する包括的な3冊シリーズ。脅威、防御、ガバナンスをカバーします。このオープンソース原稿は、セキュリティ専門家、開発者、組織のリーダーに、現代のソフトウェア開発プラクティスを保護するための実践的なガイダンスを提供します。 本書シリーズ 書籍| タイトル| 章| 焦点 ---|---|---|--- ブック1| ソフトウェアサプライチェーンの理解| 1-10| 基礎と攻撃パターン ブック2| ソフトウェアサプライチェーンの保護| 11-22| 実践的な防御と実装 ブック3| ソフトウェアサプライチェーンの統...

Malicious code in @yane88/listary-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd784784bedda93c768e67f6604062febe7761cb1ff3b1fb2178ad075aef10d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in cloufcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb997ba2e8af58bd0d35d6e2cfb2264b4ae0132e071fc5b0e3e58f3326e37a9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackoo3m1u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9409725a0c60e28d487058cfed06d57101ed7eb4fdf031e19ad43e72f2597d3c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack0y4arx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0ee85099f27ca35f55b12120ad7980852aab16079399ddf94f3dec87c8deea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackujfdgm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2410d34a77cd3d19e207d15edd8221ff5a49932ee4a6052fa30668b92e810b96 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack2cyinb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e160520778ca6e1c474aa74fb066efea18747c08d4efbafcc7ece8ae185f5b21 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-21753

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...

Malicious code in desmosmathwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccdafeec1f447c84fcca9f7f17e41c8e940b8bd65c9caf72b1bddbb2befdea4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MINI-Q664-F2C8-9R9X

Bulletin has no description...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: pvc-autoresizer-fips, logstash-exporter, crossplane-provider-azure-relay, cert-manager-openshift-routes-fips, portieris-fips, azcopy-fips, sqlexporter-fips, cephcsi-fips, frankenphp-8.4, nifikop, haproxy-ingress, flux-source-watcher, src, crossplane-provider-sql,...

Malicious code in thepackagethatworks_ (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f15296c09e590124cd0c48b05fe2a07d3a2c798fe5ffe5bbc01fa91e1eeb18c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2025-4261 vulnerabilities

Vulnerabilities for packages: gitea-fips...

GO-2026-4753 vulnerabilities

Vulnerabilities for packages: teleport, dex, omni, dex-fips, teleport-operator-fips, gotrue, neuvector-fips, rancher-agent, gotrue-fips, mattermost, neuvector, rancher, omni-fips, commercial-grafana, mattermost-fips, zitadel...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: nemo, zot, flux-kustomize-controller, goreleaser, pulumi-kubernetes-operator, kubevela, pulumi-language-yaml, bom, nuclei, grafana-alloy-fips, guac, chezmoi, flux-image-automation-controller, argo-cd, kargo, flux, snyk-cli, skaffold, grype, task, osv-scanner,...

GO-2026-4602 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, logstash-exporter, cerbos, pvc-autoresizer-fips, xcaddy, mig-parted, azcopy-fips, sqlexporter-fips, cephcsi-fips, agentbeat, gatekeeper-fips, src, flux-source-watcher, tofu-controller-fips, vault-fips, chronyexporter, terraform-provider-pagerdut...

GO-2026-5496 vulnerabilities

Vulnerabilities for packages: cerbos, nemo, rancher-fleet, pulumi-kubernetes-operator, pulumi-language-yaml, bom, nuclei, argo-cd, kubescape-server, snyk-cli, kyverno-fips, rancher-fleet-fips, apko-fips, k9s, zarf, gitea-fips, pulumi, teleport, witness, crossplane, k9s-fips, argocd-image-updater,...

GO-2025-3373 vulnerabilities

Vulnerabilities for packages: xcaddy, sqlexporter-fips, extism, haproxy-ingress, crossplane-provider-sql, prometheus-mysqld-exporter-fips, falco-exporter-fips, vault-secrets-operator, neuvector, gitea-fips, flannel-cni-plugin, nvidia-gpu-operator-validator, sbomqs, cosign-fips, cilium, vgpu-util,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, logstash-exporter, xcaddy, azcopy-fips, extism, haproxy-ingress, src, rancher-webhook, neuvector, crossplane-provider-aws-sns, cue-fips, flannel-cni-plugin, nvidia-gpu-operator-validator, sbomqs, cosign-fips, glab, cilium, vgpu-util,...