75 matches found
CVE-2024-3094-checker
CVE-2024-3094 탐지 및 조치 스크립트 이 스크립트는 XZ Utils 데이터 압축 라이브러리에 영향을 미치는 치명적인 취약점인 CVE-2024-3094를 탐지하고 조치하기 위해 설계되었습니다. 이 취약점은 CISA 경고에서 강조되었으며 시스템 보안에 중대한 영향을 미칩니다. 이 Bash 스크립트는 탐지 및 조치 기능을 모두 제공합니다. 면책 조항 이 스크립트는 어떠한 종류의 보증도 없이 "있는 그대로" 제공됩니다. 모든 환경과 구성에서 철저히 테스트되지 않았습니다. 이 스크립트를 실행함으로써 귀하는 본인 책임 하에...
tanstack-compromise-checker
tanstack-compromise-checker ⚠️ Disclaimer: Questo strumento è stato creato per il mio caso d'uso personale. Tutti gli indicatori derivano dalle seguenti fonti advisory: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm packages compromised StepSecurity: Mini Shai-Hulud deep dive Se emergono nuovi IOC,...
Malicious code in @servicetitan/titan-chatbot-ui (npm)
npm/@servicetitan/titan-chatbot-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11825 Malicious code in @servicetitan/anvil2-ext-charts (npm)
npm/@servicetitan/anvil2-ext-charts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11601 Malicious code in @onereach/idw-apps (npm)
npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...
MAL-2026-11913 Malicious code in @servicetitan/react-ioc (npm)
npm/@servicetitan/react-ioc is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11612 Malicious code in @onereach/or-pro (npm)
npm/@onereach/or-pro is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...
MAL-2026-11729 Malicious code in @or-sdk/step-templates (npm)
npm/@or-sdk/step-templates is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @onereach/si-step-chooser (npm)
npm/@onereach/si-step-chooser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @onereach/ts-memoize (npm)
npm/@onereach/ts-memoize is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...
Malicious code in @ornikar/eslint-config-formatjs (npm)
npm/@ornikar/eslint-config-formatjs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-10438 Malicious code in netspeedutil (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1 On install, setup.js walks up to the installer's project tree and scans image files for a 'STEG' marker. When found, it AES-256-CBC-decrypts an...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...
MAL-2026-3997 Malicious code in @antv/g6-wx (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/narrative-text-schema (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/li-sam-assets (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the git repository management endpoints, which lack proper role-based access control. An attacker can gain unauthorized access to sensitive Git credentials, modify or delete repository configurations, and...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
