Malicious code in huggingfaces-hub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 030324e12766820002cc282dbac28f60bb0f2fc82d459e96c82f073a14e75592 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in hllm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c984c02970a9295543df7e945c9aa0ab34b1102216b42ef189fa6d626274a00a A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in cms-core-redux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3940178777e39b1b416f9ed8d09fdf519cf9f5a3e2de2361da01655b196991d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sn-flow-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2c83ae0b3aa74be7de2508ec17549e3bc00e40edd30c62322e91be77ea48e69 package.json declares a preinstall hook "preinstall": "node index.js" that runs index.js automatically on npm install. index.js requires childprocess...

Malicious code in eslint-config-bc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6df69ef80bd1fa8d92354d60af1310a623bcc81f45747601445f423c670e0545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @linx-ui/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a70dd8ec71455f4177650ed33f72b8da1f8067e2afbebd634836da68f44cbc53 The OpenSSF Package Analysis project identified '@linx-ui/shared' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Unspecified vulnerability in Linux kernel (CNVD-2024-40294)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a security vulnerability that stems from a null pointer dereference. No details of the vulnerability are provided at this time...

Unspecified vulnerability in Linux kernel (CNVD-2024-40274)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not checking the validity of an index before accessing the bwparams array. No details of the vulnerability a...

Malicious code in storj-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c29c7e82f958f9ed89af6fc324d687bfe4e15d4b2aa49fee39f5aeeb4eee5583 The OpenSSF Package Analysis project identified 'storj-docs' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-38226

creationtimestamp| type| source ---|---|--- 2024-09-10 17:25:32+00:00| seen| https://www.thezdi.com/blog/2024/9/10/the-september-2024-security-update-review 2024-09-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1368 2024-09-11 09:47:58+00:00| exploited|...

Malicious code in cugraph-dgl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c1f145fd51ee7737cb44e28b07d4ec3bfe53f4a8aac51d0b8bce58ef8bd71f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in debug-toolbar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57a187231b24ff90938749793a1f8f768e606a7fe5da9d2c6d74510419c14ed0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in sap-adv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5935ab744274c1707e0477f65c8639076dc9448a4add5aad7fe2466cf5ee14db The OpenSSF Package Analysis project identified 'sap-adv' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...

Robotmk Security Vulnerabilities

Robotmk is an open source Robot framework integration for Checkm k by ELABIT. A security vulnerability exists in Robotmk versions prior to 2.0.1, which stems from a shared holotree usage feature that allows any user to edit any Python environment, resulting in elevated privileges for the local us...

CVE-2024-30163

creationtimestamp| type| source ---|---|--- 2024-05-19 15:31:55+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10529 2025-05-28 07:25:12+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-30163.yaml 2025-05-31...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

Malicious code in soundcloud-scrape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49aa7d872acd9b91dd62d1aec545292c8d638126b53eadcc46435726c1c4215a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uui-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20e448a4d82eef5d5f76dd3f8c325358b3b2df9e1d124b28a4a2843f466cb94a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sourcify-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b9df2af027b2402dd66d002eec5cfbf3b37918861883becfce5f43127483c9be The OpenSSF Package Analysis project identified 'sourcify-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in discord.js-self-v22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 672d9ccd18153a9163f1f9a63ec5d765f412cf86a198d526fb04ecc5aa6eab3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...