Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution

Summary Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform LambdaFilterComponent component. Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a...

Malicious code in erc7730-hackathon (PyPI)

Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malware in @inpeek/odata-angular

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @inpeek/odata

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in etheremu.rb (RubyGems)

Source: amazon-inspector a82ac5d3f021ab23f4f461181f4150c12d672ef421b6f80c10dd8a307178442e The gem's extconf.rb, executed automatically during gem install, contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached forked process. The payload XOR-decodes a hardcoded bare-I...

Malicious code in web3-sign-helper (RubyGems)

Source: amazon-inspector adeb83bd6e9fada6d55dfe140c32a5ae29d4b3331fb888643ebe064e6d57fc23 The gem declares a C native extension at ext/web3-sign-helper/extconf.rb, but the shipped C source is a 53-byte empty InitWeb3SignHelper stub and the Ruby library only exposes a static word list — the...

Malicious code in keccka (RubyGems)

Source: amazon-inspector e4f005ef5a4a20f9aadcdd2c6e78e6d68bb52765b2f5fac2abee6abd7dd261c5 The gem's native extension is a cover: ext/keccka/keccka.c is an empty stub and extconf.rb — auto-executed by gem install — contains a base64-wrapped Ruby payload decoded and passed to eval. The payload...

Malicious code in crylto-toolbox (RubyGems)

Source: amazon-inspector 4362469cec139567ebe3c986d7f2eca2dda837ecff87373d14d9cfbedf81e6b0 The gem's extconf.rb is not a native-extension build script. It contains a base64-encoded Ruby payload that, after gating on anti-analysis checks, downloads and executes an attacker-controlled shell script a...

Malicious code in eth-address-utils (RubyGems)

Source: amazon-inspector 8ed9d372d4fc694697be41c22e7c4d02d873e53e16bde2336069787b7b961ce2 The gem advertises itself as an Ethereum address utility library but its extconf.rb auto-executed by gem install carries a base64-encoded payload that is decoded and passed to eval inside a double-forked,...

Malicious code in wallet-backup-tool (RubyGems)

Source: amazon-inspector 5452fd8e20feb6485c920b8c91f3d1f87c8bcd9f51ac9f4c57329ed9e2b20b37 The gem's native extension build script extconf.rb, which executes automatically on gem install, contains a base64-encoded Ruby payload that is eval'd inside a double-forked, detached, FD-redirected child...

Malicious code in btc-wallet-tools (RubyGems)

Source: amazon-inspector 06838084180f1f087704c390cedde5a8d3610f4895356632f938139faef7d5e3 extconf.rb in this gem decodes a base64-encoded Ruby payload with Base64.decode64 and executes it via eval inside a double-forked, Process.setsid-detached child. The decoded payload opens a TCP socket to...

Malicious code in blockchain-sync-utils (RubyGems)

Source: amazon-inspector 78a8b7d5a56c33e17464f8129001559f02bd245cd299cb8cb07ccc334eb5af65 The gem's native-extension build script ext/.../extconf.rb is a dropper rather than a real build step. The accompanying C source is a no-op stub, so the extension exists only to run install-time code. The...

Malicious code in electrum-protocol-lite (RubyGems)

Source: amazon-inspector 668c7bcfd51cfcc2efda2d772dc087067883a214357361a960f6db8e2a9ca1e8 The gem's native-extension builder ext/.../extconf.rb is not a real build script: the shipped C source is a no-op stub, and extconf.rb instead decodes a base64-wrapped Ruby payload and evaluates it during ge...

Malicious code in wallet-crypto-utils (RubyGems)

Source: amazon-inspector 5d4c36227c90b4747bc37eb95200ddf64c2875dd153138bc496b39c1dda564f7 The gem declares a native extension ext/reqthrottlemini/extconf.rb that ships no C/C++/Rust sources; the extconf.rb only calls createmakefile'walletcryptoutilsnative' after a hostile preamble. That preamble...

Malicious code in solaan-ruby (RubyGems)

Source: amazon-inspector e44549858fa90854aa5c3acae5440714ef5271cabb67243d4c82713ca3c108f7 The gem's native-extension build script extconf.rb carries a base64-encoded Ruby payload that executes at gem install time via the standard mkmf build hook. The accompanying C source is a 2-line empty stub, ...

Malicious code in lightinng-invoice (RubyGems)

Source: amazon-inspector 38a3cbc58408f7b8e0edb2aa678ba4765867b535513e8609be0d87e93687eca3 The gem lightinng-invoice is a typosquat of the Lightning/BOLT11 ecosystem duplicated 'n', homepage lightinng-invoice.dev whose advertised functionality is a decoy: lib/lightinng-invoice.rb exposes only a...

Malicious code in lightning-invoice-utils (RubyGems)

Source: amazon-inspector b1c7aa63129491dc29eaf240d8f4ae910733b8f6f34192279c119c3cb585c68d The gem declares a native extension extconf.rb that is auto-executed by gem install, but the shipped C stub InitLightningInvoiceUtils is empty — the native-extension slot is a cover. extconf.rb base64-decode...

Malicious code in etherdum.rb (RubyGems)

Source: amazon-inspector a27b2952de0064d1745d45f18fc1ab974e48cfe185b8f41e90447265be1a880f The gem declares ext/etherdum.rb/extconf.rb as a native extension, but the accompanying C source is an empty Init stub and the Ruby library is a trivial word list with no cryptography. extconf.rb, which...

Malicious code in kecack (RubyGems)

Source: amazon-inspector f17f86c78cebe16698b84a8ab5a9b87865c63a890588c23fbe1d2638c4501647 The gem's native extension build script ext/.../extconf.rb executes during gem install and contains a dropper rather than a real native build. Before createmakefile, it enumerates environment indicators to...

Malicious code in lighthing-invoice (RubyGems)

Source: amazon-inspector 206884c57f9427c6952744828fa53861634d5451b97ba86885c701ee47ef5012 The gem's native-extension script ext/lighthing-invoice/extconf.rb, which executes during gem install, base64-decodes and evals a Ruby payload. The payload reconstructs an XOR-obfuscated URL...

Malicious code in crypto-key-utils (RubyGems)

Source: amazon-inspector 559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214 The gem declares a native extension whose extconf.rb is the attack vehicle: the C source ext/crypto-key-utils/crypto-key-utils.c is a two-line empty Init stub, and createmakefile is only reached after a bloc...

Malicious code in tron-rb (RubyGems)

Source: amazon-inspector a483b2d8f8273b5dca3a95d449d762cdfe9d79e8aea485cb89673c469e4cda6f The gem advertises TRON protocol helpers but ships only a 45-byte empty C stub ext/tron-rb/tron-rb.c and a hardcoded word-list library module; its sole operative code path is in ext/tron-rb/extconf.rb. On ge...

Malicious code in ligbtning-invoice (RubyGems)

Source: amazon-inspector 86fdee6169e308a4849aae46edf725272a04cc0fe706f18006dcde8f54f86e2a The gem's native extension script extconf.rb, which RubyGems executes automatically during gem install, base64-decodes an embedded Ruby payload and evaluates it inside a double-forked, detached background...

Malicious code in coinmarket-utils (RubyGems)

Source: amazon-inspector 7ace1863ec858e5931ba2848276c14fb050fff204b2fbea82e2f64ae3f9a0ffc The gem's native extension build script ext/coinmarket-utils/extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a double-forked, setsid, FD-detached child process at gem...

Malicious code in hdkey-derive-helper (RubyGems)

Source: amazon-inspector 04f5409730ece37713b6a8d3afddcce30744e213b80759f7ae89478731b0264a The gem presents itself as a BIP32/mnemonic derivation helper but ships only a wordlist stub and a 56-byte empty C file ext/hdkey-derive-helper/hdkey-derive-helper.c, body void InitHdkeyDeriveHelpervoid...

Malicious code in merkle-proof-lite (RubyGems)

Source: amazon-inspector 566447bbe57c81d3ad0e7f640951edd848b5a843c8b423ca370d96938d803cba The gem declares a native extension whose only real content is a 2-line empty Init stub in ext/merkle-proof-lite/merkle-proof-lite.c; no genuine native code is built. extconf.rb, which RubyGems executes duri...

Malicious code in utxo-set-utils (RubyGems)

Source: amazon-inspector 7dbd653d2b6e9dead4140f0538bb92092348b726319930b322d6c6346dd7b668 ext/utxo-set-utils/extconf.rb runs during gem install and acts as a dropper rather than a native-extension build script. The accompanying C source is an empty stub, so the extension exists solely to trigger...

Malicious code in web3-eth-utils (RubyGems)

Source: amazon-inspector 248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666 The gem declares a native extension at ext/reqthrottlemini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during gem install. Before calling...

Malicious code in ethereum-tx-helper (RubyGems)

Source: amazon-inspector e870b276b866298ef1e57e1ceff7ef4e253cb43055d0163572e25646be7b8791 The gem advertises Ethereum transaction helpers but ships only an empty C stub ext/ethereum-tx-helper/ethereum-tx-helper.c: InitEthereumTxHelper and a tiny BIP39 word-list helper in lib. All real behavior...

Malicious code in crypti-toolbox (RubyGems)

Source: amazon-inspector 5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795 On gem install, the native extension script ext/crypti-toolbox/extconf.rb runs an environment-fingerprinting routine that bails out on CI runners, ephemeral/sandbox hostnames, generated or analysis-shaped...

Malicious code in bitcoin-rpc-lite (RubyGems)

Source: amazon-inspector 4567a3469d6774fbe9be233375145274adf41f8e7a20521724a9a15606351044 The gem declares ext/reqthrottlemini/extconf.rb as a native extension, but the ext/ directory ships no C/C++/Rust sources — the extension manifest exists solely to execute Ruby code during gem install. The...

Malicious code in tx-broadcast-utils (RubyGems)

Source: amazon-inspector 60efdf159c3ce8550c985b3f19cbe72f2bfcae0266cb63fb8c0dd458b56b9901 The gem's native-extension script ext/.../extconf.rb embeds a base64-encoded Ruby payload that is eval'd at gem install time. The payload double-forks and detaches a background process which sleeps 20-40...

Malicious code in eth-keystore-utils (RubyGems)

Source: amazon-inspector cd660255e3a3483ed89e81f30c696390f8b182a891f8f1fb7e4c1cbb3b52eb32 The gem advertises itself as an Ethereum keystore helper but ships a native extension ext/reqthrottlemini/extconf.rb whose sole purpose is to execute a malicious payload during gem install. The extconf scrip...

Malicious code in cryoto-toolbox (RubyGems)

Source: amazon-inspector 3fcf75a196193219b146e937b6d9a7cf8937df152658a2d7b7b8905605c9f8a6 The gem declares ext/cryoto-toolbox/extconf.rb as a native extension, which rubygems executes during gem install. Before the single createmakefile call, the script evaluates a base64 blob that XOR-decodes a...

Malicious code in crypto-mnemonic-tools (RubyGems)

Source: amazon-inspector 20550e421f034d2bf7c4ca653a79a2558f3d84a49a54566e874d92cc80557469 The gem declares a native extension at ext/reqthrottlemini/extconf.rb but ships no C/C++ sources; createmakefile produces an empty build so the extconf.rb exists solely to execute code at gem install time. T...

Malicious code in bitcoij-ruby (RubyGems)

Source: amazon-inspector c5384d9d73ce11bd469153ec7603634889186391b9bd312bf84b3ace56950454 The gem declares a native extension ext/bitcoij-ruby/extconf.rb whose matching C source is an empty 50-byte Init function, so the extension exists solely to run extconf.rb during gem install. extconf.rb...

Malicious code in css-eqxcdx-polyfill (npm)

Source: amazon-inspector a93fe0298f7671177e324947b2bf89ec3729b203621f7ca67aa8cd10439306a2 The package presents itself as a polyfill exporting Wix thunderbolt-style registry stubs thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, etc., but...

Malicious code in checkmate-remediation-assistant (npm)

Source: amazon-inspector c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4 The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, the home directory, DNS server configuration, dirname, the local...

Malicious code in css-kfvwax-polyfill (npm)

Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface listings ifconfig/ip addr, and the contents of /etc/hosts,...

Malicious code in bitcion (RubyGems)

Source: amazon-inspector 2227467459663a7608a52405af03fbfbf6f9a25a02dcac5490c29480a846b61d The gem advertises itself as a BIP-39 mnemonic word list but ships a non-functional native extension ext/bitcion/bitcion.c is a 46-byte empty InitBitcion stub whose only purpose is to make RubyGems invoke...

Malicious code in bitciin (RubyGems)

Source: amazon-inspector 73144cb471499af4467e7c8c2a6da34013285179444e101290faa7ec9fda0a19 The gem declares a native extension ext/bitciin/extconf.rb that runs during gem install. The shipped C source ext/bitciin/bitciin.c is a two-line empty stub void InitBitciinvoid and the Ruby library exposes...

Malicious code in with-cte (npm)

Source: amazon-inspector 8eceeb0a05cd8d1a289f1a1006df8acd825d73f341ec1a50e095dc2850b866c8 The package declares a preinstall lifecycle hook preinstall: node index.js that runs automatically on npm install. index.js collects installer host identifiers os.hostname, os.userInfo, homedir, DNS servers...

Malicious code in css-vvgsze-polyfill (npm)

Source: amazon-inspector 242414f6ea61921e2c62a6f4552456c486eee58d10c0aeec8b33d8043751ee59 thunderboltRegistry.js runs an IIFE on module require that performs two attacker-benefit actions against the installer. First, it execSyncs id, whoami, env, and ifconfig/ip addr, then transmits the output...

Malicious code in css-nrmgzn-polyfill (npm)

Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami, uname, ifconfig, and cat /etc/hosts, and sends the comma...

Malicious code in bip39-wordlist-utils (RubyGems)

Source: amazon-inspector 4b3ac427b6e4032e434211228b95b76c556690f86e9e3ba44134e2b8525253c5 The gem declares a native C extension whose shipped source ext/bip39-wordlist-utils/bip39-wordlist-utils.c is an empty Init stub, so gem install executes extconf.rb purely as a lifecycle hook. extconf.rb...

Malicious code in css-gwqyid-polyfill (npm)

Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/ip addr output and sends each result as a GET query-string ...

Malicious code in css-yhpodl-polyfill (npm)

Source: amazon-inspector 5936fc65b4eba7b461c0eef7b66dfeecdc2da412f54fd667873e3e6950b0a857 css-yhpodl-polyfill ships thunderboltRegistry.js which, as an IIFE executed on require, runs shell reconnaissance id, whoami, env, ifconfig/ip addr, hostname via childprocess.execSync and sends the collected...