Search: com.ar

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686) The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, then POSTs a JSON payload over HTTPS to a hardcoded Burp Collaborator subdomain n6usddpvkn7jcauar9va0xvleck48uwj.oastify.com. The package name mimics a documentation package for karapace (a Kafka registry project), consistent with a dependency-confusion / typosquat recon payload. Installer host identity and local system file contents leave the machine to an attacker-controlled OAST endpoint on `npm install` with no user interaction. ## Source: ghsa-malware (0504b1eeee4b53817289d98df2d4b44775e97feea2be622a724012a4dc60576f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6ad1c6bad5ee8d3cb562503b94d5534ba2c98ad5b4854c073e1482d59ab8687e) package.json declares a preinstall hook that runs index.js during `npm install`. The script reads /etc/passwd, /etc/hosts, os.hostname(), os.userInfo().username, the user's home directory, dns.getServers(), and package metadata, then POSTs the collected data via HTTPS to the hardcoded subdomain 7ckdbwo9f8dtrg8y36sbe4e8lzrqfg35.oastify.com (Burp Collaborator OAST callback). The exfiltration fires automatically at install time without user interaction. ## Source: ghsa-malware (da7109b04e5b66699eebc1d774b016c4603a4fb0932136d62c0c3be356d5bb2b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b635b8b6d257c079a0d0a9c06e37910b67f2e75d1e71dced264043624951ce06) package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, DNS servers, cwd, package.json contents) and reads /etc/passwd and /etc/hosts, then POSTs the resulting JSON over HTTPS to the hardcoded out-of-band collaborator subdomain lsh5x8dwumsekllw37kacgaqxh3cr2fr.oastify.com. The destination is a Burp Collaborator OOB endpoint unrelated to any documented package purpose, and execution is automatic at install time. ## Source: ghsa-malware (0723c99e49b056e9d946985e6401afa50ee28e766b0e7e0993914f4ad3538723) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498) Package targets the electrode-io internal name `electrode-ota-ui-app` with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both `main: index.js` and `scripts.postinstall: node index.js`, so on `npm install` and on any `require()` the package unconditionally runs `collectAndSend()` in index.js. That function gathers host identifiers via `os.hostname()`, `os.userInfo()`, `os.platform()`, and `os.release()`, resolves the installer's public IP via ipify and geo/ISP data via ipapi.co, and POSTs a JSON payload to the hardcoded Burp Collaborator subdomain `https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback`, controlled by the package author. README self-labels as a dependency-confusion PoC, but the callback is live and any installer whose resolver picks this public package over the intended internal one is compromised.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b) The package's preinstall script (`node index.js`) auto-executes on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, home directory, DNS servers) along with the contents of /etc/passwd and /etc/hosts, then POSTs them via HTTPS to a hardcoded Burp Collaborator subdomain at 2ru8qr34u3so6bnti176tzt30u6muci1.oastify.com. The package name mimics an Azure DevOps MATLAB extension but ships no legitimate functionality (empty author, empty description); the package exists only to run the exfil beacon. Consistent with a dependency-confusion / recon probe. ## Source: ghsa-malware (db5089aca87fa4e104e5c3395d2a884191c1ffe1d146bf73b0f255872b59e55e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e6e8d8500ee41d92250882b57d98d805b381d2d08eeeac7bae55c3f5e417dff) package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects the installer's hostname, username, home directory, DNS server configuration, current working directory, and the contents of /etc/passwd and /etc/hosts, then POSTs this payload over HTTPS to the hardcoded subdomain x75h3spwmlqq7bzriw6gm6w8azgq4hs6.oastify.com (a Burp Collaborator out-of-band interaction host). Execution is automatic at install time with no consent prompt and no documented purpose. The behavior matches a dependency-confusion reconnaissance beacon that exfiltrates installer host identity and local system files to an attacker-controlled endpoint. ## Source: ghsa-malware (a7d5d00e0c243819b3d1813314c4f4ef596f92a034d82e0a5acce92740bed5d5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463) package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance (os.hostname(), os.userInfo(), homedir, DNS server list, current working directory, package.json contents) and reads /etc/passwd and /etc/hosts from the installer's filesystem, then POSTs the aggregated JSON over HTTPS to the hardcoded Burp Collaborator subdomain ie02j5ztgjeb6i7tp467ydwnjep8dy1n.oastify.com. The package name mimics a legitimate SDK category but its only behavior on install is this exfiltration beacon. ## Source: ghsa-malware (39394cd04a494a4f6dceff2f54848e93a56bbbab2663fe9b48611ea39df58808) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8) fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host metadata from the installer machine — `os.hostname()`, `os.platform()`, `os.arch()`, the user home directory path, and configured DNS servers — and issues an HTTPS POST to a hardcoded Burp Collaborator subdomain (`mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com/hit`) with that data as a JSON body. The beacon fires automatically at install time with no user interaction. The destination is an attacker-controlled out-of-band interaction endpoint typical of dependency-confusion reconnaissance, confirming to the operator that the package name was successfully resolved and installed inside a target build environment.

The npm package com.db.dbk.ui-forms versions 99.0.0 and 99.0.1 contains malicious code that executes automatically during installation. It collects sensitive host information and environment variables potentially containing secrets, then exfiltrates this data to a hardcoded external server. The package is described as a 'dependency confusion proof of concept' but performs unauthorized data exfiltration regardless.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5) The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent (module github.com/ccfly/rescue) that, when executed, connects to a hardcoded remote broker at cc.hn / ccfly over WebSocket (ws://ccfly, wss://, https://cc.hn) using github.com/gorilla/websocket, spawns a pseudo-terminal via github.com/creack/pty, and pipes the WebSocket stream into that PTY. Symbols include agent.serve, agent.startPTY, agent.waitAuthorized, agent.wsBase and unixPTY.Read/Write/Resize/Close, giving the remote party interactive shell control of the host. A second stage (setup.downloadCcfly, setup.fetchAndExtract, setup.npmTarballURL, setup.extractFromTarGz, setup.runCcflyInstall, setup.redeemEnrollToken, setup.(*brokerClient).escalateToRescue, with a rodata reference to https://registry.npmjs.org) fetches and executes a further ccfly npm tarball after the broker approves an enrollment token — the additional code executed on the host is chosen by the remote broker, not the installer. The binary also inspects shell RC files and /etc/hosts (setup.scanShellProfilesForProxy, setup.checkProxyResidue, setup.checkHostsResidue, setup.runEnvChecks, setup.envReport) and POSTs an environment report back to the broker (setup.(*brokerClient).post; rodata latest.zshrc, export.ccfly).

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379) Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the paired remote peer directly onto the installer host. MessageSend envelopes are fed as prompts into a Claude Code SDK session started with permissionMode 'bypassPermissions' (via a detected local claude executable), enabling the remote peer to drive Claude's autonomous Bash/Edit/Write tool loop on the local machine without confirmation. FileRead, FileWrite, FileTree, and FileSearch envelopes are executed directly against the local filesystem with peer-supplied paths, providing an independent remote read/write channel. AgentUpdate envelopes spawn a detached child process (node <argv1> update) that stops the daemon, runs npm install, and restarts, letting the remote peer trigger package-manager operations and process restarts. The install subcommand registers OS-level auto-start entries (HKCU Run key on Windows, a systemd user unit on Linux, a launchd plist on macOS) so the daemon re-launches at every login, providing persistent reachability for the remote-control channel. The WebSocket endpoint is a first-party server matching the package's advertised purpose (a remote agent bridge to a paired mobile app), and the daemon runs only when the operator explicitly starts it, but any party who controls or compromises that server, or MITMs the connection, obtains full-host RCE and arbitrary filesystem read/write on every installer running the daemon. ## Source: ghsa-malware (ebc37975a427916a53e540e0d1bdcf6af66c169f6d4d6b008d186a2e64912ac8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (45fa3b05e748470cdc08e19b2e86efb8a34c85f155e5972c1b0c0598c150a0bd) The package's fesm2022 ESM entry (declared as `module` in package.json and executed on `import` of the library) ends with a trailing `eval(atob('...'))` payload that, once decoded, requires `child_process`, `http`, `https`, and `zlib` via `\uXXXX`-escaped identifier strings to hide the imports from static scanners. The loader queries an Ethereum contract at `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a` through `https://eth.blockscout.com/api` (with public RPC fallbacks `1rpc.io/eth`, `eth.drpc.org`, `ethereum-rpc.publicnode.com`, `eth-mainnet.public.blastapi.io`) to read attacker-controlled host/port values from contract storage, then reaches those hosts over HTTP at paths `http://${host}:443/0x/cls` and `http://${host}:443/0x/ls` and passes the returned bytes to `child_process.spawn`. This is an EtherHiding remote-code-execution channel: consuming the library in any Node context that evaluates the ESM (SSR, build tooling, dev servers, tests) triggers on-chain-directed download and execution of arbitrary attacker code. The loader is unrelated to the package's advertised checkout functionality, is appended after the legitimate `export { ZahlenModule,... }` bundle, and is base64+unicode-obfuscated — hallmarks of an injected supply-chain payload rather than package feature code. ## Source: ghsa-malware (a3a38f34dcb95f0e345748ebb65454acd70b9fef5253e93f63e74c87b5278f23) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2) The package declares a preinstall lifecycle hook that runs index.js on `npm install`. index.js collects host identifiers and system files (os.hostname(), os.userInfo(), home directory, DNS servers, /etc/passwd, /etc/hosts, and package.json contents) and POSTs them via HTTPS to the hardcoded subdomain lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com — a Burp Collaborator out-of-band interaction host used for reconnaissance. There is no advertised functional purpose in the package that would justify this data collection; the code path exists solely to transmit installer host and credential-adjacent file contents to an attacker-controlled endpoint. ## Source: ghsa-malware (87310aa13634f4a26c92164452e9ff0c95d3ee5924feb2f6b5c48354d32ee482) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f) build/index.js appends an eval(atob('...')) block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, blastapi.io) for transactions from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f01210639aDC2490Ef1a), reconstructs an IPv4 address from the bytes of tx.to, then fetches http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls. The response body is XOR-decoded with a hardcoded key and executed via eval() and a detached spawn('node','-e',...) child process (detached:true, stdio:'ignore', windowsHide:true, unref()). The C2 endpoint is mutable — the attacker rotates it by publishing new on-chain transactions from the controlled wallet — giving persistent remote code execution on any machine that imports the library. All require targets, URLs, HTTP header/method names, and error strings in the appended region are written as \u00XX unicode escapes and wrapped in base64+atob+eval; the legitimate __exportStar re-exports above the appended block are plain text, so the sole obfuscated region is the loader. ## Source: ghsa-malware (cd595e257df7f4732d6451f4cb0203806490fb7226f8815b0c583cf860d3b3ce) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (097440ff1155e4d840568cf0fc8502c00d43249340f0f301167a859fd34c9fe8) The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation (\uXXXX) to hide imports of Node built-ins including child_process (spawn), http, https, zlib, and url. The prelude resolves a command-and-control host by querying Ethereum blockchain state via https://eth.blockscout.com/api keyed off contract address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a (with a public ETH RPC fallback list), then polls http://<resolved-host>:443/0x/ls and /0x/cls on that host and feeds the retrieved tasks into child_process.spawn, giving a remote operator arbitrary command execution on any developer machine or CI runner that installs or imports the package. The prelude also stashes global.r=require and global.m=module so C2-delivered payloads can load additional Node built-ins without repeating the unicode-escaped require dance. The React checkout code shipped below the prelude is cover; the on-chain C2 resolution is a rotation mechanism that lets the operator move infrastructure without republishing the package. ## Source: ghsa-malware (e8ea4ffb2df60ad2438699518b35cd7acdf501aa0de47a10a479f4a523079b7f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47) build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any consumer require()s @rentwise/common. The decoded payload queries public Ethereum JSON-RPC nodes and eth.blockscout.com/api to fetch the latest transaction sent by the hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, reconstructs an IPv4 address from the transaction's tx.to field (bytes 0-3 as octets), then HTTP GETs http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The response body is XOR-decoded using the x-payload-b64 header, eval()'d in-process, and additionally spawned as a detached `node -e <payload>` child process with stdio:ignore and windowsHide. All strings (module names http/https/zlib/child_process, URLs, RPC method names) are \uXXXX-escaped inside the base64 blob to defeat static string matching. The blockchain-anchored C2 (EtherHiding pattern) lets the operator rotate infrastructure by broadcasting a new on-chain transaction. This grants arbitrary remote code execution on any host that installs and loads the package. ## Source: ghsa-malware (0bbef705c23f606ecd8e4257d3de3818a1e460136c9c3aa8a5aafa1b93c0585b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the ASF. Lucy is now maintained outside of the ASF at https://github.com/lucysearch

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.