75 matches found
CVE-2024-3094-checker
نص برمجي للكشف عن الثغرة CVE-2024-3094 ومعالجتها تم تصميم هذا النص البرمجي للكشف عن ثغرة أمنية خطيرة، CVE-2024-3094، ومعالجتها، والتي تؤثر على مكتبة ضغط البيانات XZ Utils. تم تسليط الضوء على هذه الثغرة في تنبيه من وكالة الأمن السيبراني وأمن البنية التحتية CISA ولها آثار كبيرة على أمان النظام. يقد...
tanstack-compromise-checker
tanstack-compromise-checker ⚠️ تنبيه: تم بناء هذه الأداة لاستخدامي الشخصي. جميع المؤشرات مستمدة من مصادر الاستشارات التالية: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm packages compromised StepSecurity: Mini Shai-Hulud deep dive في حال ظهور مؤشرات IOCs جديدة أو متغيرات حمولة أو بنية تحتية للمهاجم بعد...
Malicious code in @servicetitan/titan-chatbot-ui (npm)
npm/@servicetitan/titan-chatbot-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11825 Malicious code in @servicetitan/anvil2-ext-charts (npm)
npm/@servicetitan/anvil2-ext-charts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11601 Malicious code in @onereach/idw-apps (npm)
npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...
MAL-2026-11913 Malicious code in @servicetitan/react-ioc (npm)
npm/@servicetitan/react-ioc is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11612 Malicious code in @onereach/or-pro (npm)
npm/@onereach/or-pro is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...
MAL-2026-11729 Malicious code in @or-sdk/step-templates (npm)
npm/@or-sdk/step-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @onereach/si-step-chooser (npm)
npm/@onereach/si-step-chooser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @onereach/ts-memoize (npm)
npm/@onereach/ts-memoize is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...
Malicious code in @ornikar/eslint-config-formatjs (npm)
npm/@ornikar/eslint-config-formatjs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-10438 Malicious code in netspeedutil (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1 On install, setup.js walks up to the installer's project tree and scans image files for a 'STEG' marker. When found, it AES-256-CBC-decrypts an...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...
MAL-2026-3997 Malicious code in @antv/g6-wx (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/narrative-text-schema (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/li-sam-assets (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the git repository management endpoints, which lack proper role-based access control. An attacker can gain unauthorized access to sensitive Git credentials, modify or delete repository configurations, and...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
