VULN/vuln-osv
1
0
Fork 0
Code Pull Requests Actions Activity

vuln-osv update 2026-11-11T18:46:30Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-11 19:46:34 +01:00
parent ec3c3bd599
commit 1a6edb2c48
59 changed files with 66 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/OSS-Fuzz/OSV-2021-1070.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2021-1070","published":"2021-07-29T00:01:10.187569Z","modified":"2026-11-09T14:30:04.965987346Z","summary":"Heap-buffer-overflow in ZSTD_decompressBlock_internal","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nZSTD_decompressBlock_internal\nZSTD_decompressMultiFrame\nZSTD_decompressDCtx\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"861ba79f31393dec0a0782ca11cf32cebb6f6610"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1070.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623"}]}
{"schema_version":"1.9.2","id":"OSV-2021-1070","published":"2021-07-29T00:01:10.187569Z","modified":"2026-11-11T14:30:03.340554694Z","summary":"Heap-buffer-overflow in ZSTD_decompressBlock_internal","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nZSTD_decompressBlock_internal\nZSTD_decompressMultiFrame\nZSTD_decompressDCtx\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"861ba79f31393dec0a0782ca11cf32cebb6f6610"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1070.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623"}]}
data/OSS-Fuzz/OSV-2021-1086.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2021-1343.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2021-1672.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2021-1672","published":"2021-12-12T00:01:29.747137Z","modified":"2026-11-09T14:30:04.967390122Z","summary":"Heap-buffer-overflow in blosc_d","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nblosc_d\ndo_job\nblosc_run_decompression_with_context\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1672.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210"}]}
{"schema_version":"1.9.2","id":"OSV-2021-1672","published":"2021-12-12T00:01:29.747137Z","modified":"2026-11-11T14:30:03.341943960Z","summary":"Heap-buffer-overflow in blosc_d","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nblosc_d\ndo_job\nblosc_run_decompression_with_context\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1672.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210"}]}
data/OSS-Fuzz/OSV-2021-820.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2021-820","published":"2021-06-02T00:00:31.619765Z","modified":"2026-10-28T15:45:09.151266043Z","summary":"UNKNOWN READ in virtio_gpu_disable_scanout","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34831\n\n```\nCrash type: UNKNOWN READ\nCrash state:\nvirtio_gpu_disable_scanout\nvirtio_gpu_set_scanout\nvirtio_gpu_simple_process_cmd\n```\n","affected":[{"package":{"name":"qemu","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qemu"},"ranges":[{"type":"GIT","repo":"https://git.qemu.org/git/qemu.git","events":[{"introduced":"e64d4b6a9bc3ba216a988276bcdc27d06fd48e59"}]}],"versions":["v6.1.0-rc0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.0","v6.1.1","v6.2.0","v6.2.0-rc0","v6.2.0-rc1","v6.2.0-rc3","v6.2.0-rc4","v7.0.0","v7.0.0-rc0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.1.0","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v7.2.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v7.2.1","v8.0.0-rc3","v8.0.0-rc4","v8.0.0","v7.2.2","v7.2.3","v8.0.1","v8.0.2","v7.2.4","v8.0.3","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v7.2.5","v8.0.4","v8.1.0-rc3","v8.1.0-rc4","v8.1.0","v7.2.6","v8.0.5","v8.1.1","v8.1.2","v8.2.0-rc0","v7.2.7","v8.1.3","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v8.2.0","v7.2.8","v8.1.4","v7.2.9","v8.1.5","v8.2.1","v7.2.10","v8.2.2","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v7.2.11","v8.2.3","v9.0.0","v8.2.4","v7.2.12","v8.2.5","v9.0.1","v7.2.13","v8.2.6","v9.0.2","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.1.0","v7.2.14","v8.2.7","v9.0.3","v9.1.1","v9.2.0-rc0","v7.2.15","v8.2.8","v9.0.4","v9.1.2","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3","v9.2.0","v7.2.16","v8.2.9","v9.1.3","v9.2.1","v9.2.2","v10.0.0-rc0","v10.0.0-rc1","v7.2.17","v8.2.10","v9.2.3","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v10.0.0","v10.0.1","v7.2.18","v9.2.4","v10.0.2","v10.0.3","v10.1.0-rc0","v7.2.19","v10.0.4","v10.1.0","v10.1.0-rc1","v10.1.0-rc2","v10.1.0-rc3","v10.1.0-rc4","v7.2.20","v10.0.5","v10.1.1","v7.2.21","v10.0.6","v10.1.2","v10.2.0-rc1","v10.2.0-rc2","v10.0.7","v10.1.3","v7.2.22","v10.2.0-rc3","v10.2.0-rc4","v10.2.0","v10.0.8","v10.1.4","v10.2.1","v10.0.9","v10.1.5","v10.2.2","v11.0.0-rc0","v11.0.0-rc1","v11.0.0-rc2","v11.0.0-rc3","v11.0.0-rc4","v11.0.0","v10.0.10","v10.2.3","v11.0.1","v10.0.11","v10.2.4","v11.0.2","v10.0.12","v11.0.3","v11.1.0-rc0","v11.1.0-rc1","v11.1.0-rc2","v11.1.0-rc3","v11.1.0","v10.0.13","v11.0.4","v11.1.1","v10.0.14","v11.0.5","v11.1.2","v10.0.15","v11.1.3","v6.2.0-rc2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qemu/OSV-2021-820.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34831"}]}
{"schema_version":"1.9.2","id":"OSV-2021-820","published":"2021-06-02T00:00:31.619765Z","modified":"2026-11-11T15:00:08.495631556Z","summary":"UNKNOWN READ in virtio_gpu_disable_scanout","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34831\n\n```\nCrash type: UNKNOWN READ\nCrash state:\nvirtio_gpu_disable_scanout\nvirtio_gpu_set_scanout\nvirtio_gpu_simple_process_cmd\n```\n","affected":[{"package":{"name":"qemu","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qemu"},"ranges":[{"type":"GIT","repo":"https://git.qemu.org/git/qemu.git","events":[{"introduced":"e64d4b6a9bc3ba216a988276bcdc27d06fd48e59"}]}],"versions":["v6.1.0-rc0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.0","v6.1.1","v6.2.0","v6.2.0-rc0","v6.2.0-rc1","v6.2.0-rc3","v6.2.0-rc4","v7.0.0","v7.0.0-rc0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.1.0","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v7.2.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v7.2.1","v8.0.0-rc3","v8.0.0-rc4","v8.0.0","v7.2.2","v7.2.3","v8.0.1","v8.0.2","v7.2.4","v8.0.3","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v7.2.5","v8.0.4","v8.1.0-rc3","v8.1.0-rc4","v8.1.0","v7.2.6","v8.0.5","v8.1.1","v8.1.2","v8.2.0-rc0","v7.2.7","v8.1.3","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v8.2.0","v7.2.8","v8.1.4","v7.2.9","v8.1.5","v8.2.1","v7.2.10","v8.2.2","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v7.2.11","v8.2.3","v9.0.0","v8.2.4","v7.2.12","v8.2.5","v9.0.1","v7.2.13","v8.2.6","v9.0.2","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.1.0","v7.2.14","v8.2.7","v9.0.3","v9.1.1","v9.2.0-rc0","v7.2.15","v8.2.8","v9.0.4","v9.1.2","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3","v9.2.0","v7.2.16","v8.2.9","v9.1.3","v9.2.1","v9.2.2","v10.0.0-rc0","v10.0.0-rc1","v7.2.17","v8.2.10","v9.2.3","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v10.0.0","v10.0.1","v7.2.18","v9.2.4","v10.0.2","v10.0.3","v10.1.0-rc0","v7.2.19","v10.0.4","v10.1.0","v10.1.0-rc1","v10.1.0-rc2","v10.1.0-rc3","v10.1.0-rc4","v7.2.20","v10.0.5","v10.1.1","v7.2.21","v10.0.6","v10.1.2","v10.2.0-rc1","v10.2.0-rc2","v10.0.7","v10.1.3","v7.2.22","v10.2.0-rc3","v10.2.0-rc4","v10.2.0","v10.0.8","v10.1.4","v10.2.1","v10.0.9","v10.1.5","v10.2.2","v11.0.0-rc0","v11.0.0-rc1","v11.0.0-rc2","v11.0.0-rc3","v11.0.0-rc4","v11.0.0","v10.0.10","v10.2.3","v11.0.1","v10.0.11","v10.2.4","v11.0.2","v10.0.12","v11.0.3","v11.1.0-rc0","v11.1.0-rc1","v11.1.0-rc2","v11.1.0-rc3","v11.1.0","v10.0.13","v11.0.4","v11.1.1","v10.0.14","v11.0.5","v11.1.2","v10.0.15","v11.1.3","v11.2.0-rc0","v6.2.0-rc2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qemu/OSV-2021-820.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34831"}]}
data/OSS-Fuzz/OSV-2022-1134.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2022-1134","published":"2022-11-04T00:02:11.463429Z","modified":"2026-11-09T14:30:04.965661082Z","summary":"Heap-buffer-overflow in ndlz8_decompress","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nndlz8_decompress\nblosc_d\ndo_job\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"1c9795f2e3e04a79f13d9e7658e6d6e47dfe1cc4"}]}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2022-1134.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967"}]}
{"schema_version":"1.9.2","id":"OSV-2022-1134","published":"2022-11-04T00:02:11.463429Z","modified":"2026-11-11T14:30:03.340465029Z","summary":"Heap-buffer-overflow in ndlz8_decompress","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nndlz8_decompress\nblosc_d\ndo_job\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"1c9795f2e3e04a79f13d9e7658e6d6e47dfe1cc4"}]}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2022-1134.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967"}]}
data/OSS-Fuzz/OSV-2022-1176.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-1198.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-1259.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-372.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-379.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-388.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-400.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-581.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2022-581","published":"2022-07-14T00:00:45.644503Z","modified":"2026-10-28T16:45:04.382621645Z","summary":"Heap-buffer-overflow in megasas_map_sgl","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49086\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nmegasas_map_sgl\nmegasas_mmio_write\nmegasas_port_write\n```\n","affected":[{"package":{"name":"qemu","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qemu"},"ranges":[{"type":"GIT","repo":"https://git.qemu.org/git/qemu.git","events":[{"introduced":"0e042025b9fe262316f29e4b8ec47f0b85c24e5f"}]}],"versions":["v6.2.0","v6.2.0-rc0","v6.2.0-rc1","v6.2.0-rc3","v6.2.0-rc4","v7.0.0","v7.0.0-rc0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v7.2.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v7.2.1","v8.0.0-rc3","v8.0.0-rc4","v8.0.0","v7.2.2","v7.2.3","v8.0.1","v8.0.2","v7.2.4","v8.0.3","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v7.2.5","v8.0.4","v8.1.0-rc3","v8.1.0-rc4","v8.1.0","v7.2.6","v8.0.5","v8.1.1","v8.1.2","v8.2.0-rc0","v7.2.7","v8.1.3","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v8.2.0","v7.2.8","v8.1.4","v7.2.9","v8.1.5","v8.2.1","v7.2.10","v8.2.2","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v7.2.11","v8.2.3","v9.0.0","v8.2.4","v7.2.12","v8.2.5","v9.0.1","v7.2.13","v8.2.6","v9.0.2","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.1.0","v7.2.14","v8.2.7","v9.0.3","v9.1.1","v9.2.0-rc0","v7.2.15","v8.2.8","v9.0.4","v9.1.2","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3","v9.2.0","v7.2.16","v8.2.9","v9.1.3","v9.2.1","v9.2.2","v10.0.0-rc0","v10.0.0-rc1","v7.2.17","v8.2.10","v9.2.3","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v10.0.0","v10.0.1","v7.2.18","v9.2.4","v10.0.2","v10.0.3","v10.1.0-rc0","v7.2.19","v10.0.4","v10.1.0","v10.1.0-rc1","v10.1.0-rc2","v10.1.0-rc3","v10.1.0-rc4","v7.2.20","v10.0.5","v10.1.1","v7.2.21","v10.0.6","v10.1.2","v10.2.0-rc1","v10.2.0-rc2","v10.0.7","v10.1.3","v7.2.22","v10.2.0-rc3","v10.2.0-rc4","v10.2.0","v10.0.8","v10.1.4","v10.2.1","v10.0.9","v10.1.5","v10.2.2","v11.0.0-rc0","v11.0.0-rc1","v11.0.0-rc2","v11.0.0-rc3","v11.0.0-rc4","v11.0.0","v10.0.10","v10.2.3","v11.0.1","v10.0.11","v10.2.4","v11.0.2","v10.0.12","v11.0.3","v11.1.0-rc0","v11.1.0-rc1","v11.1.0-rc2","v11.1.0-rc3","v11.1.0","v10.0.13","v11.0.4","v11.1.1","v10.0.14","v11.0.5","v11.1.2","v10.0.15","v11.1.3","v6.2.0-rc2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qemu/OSV-2022-581.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49086"}]}
{"schema_version":"1.9.2","id":"OSV-2022-581","published":"2022-07-14T00:00:45.644503Z","modified":"2026-11-11T15:00:08.496704178Z","summary":"Heap-buffer-overflow in megasas_map_sgl","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49086\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nmegasas_map_sgl\nmegasas_mmio_write\nmegasas_port_write\n```\n","affected":[{"package":{"name":"qemu","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qemu"},"ranges":[{"type":"GIT","repo":"https://git.qemu.org/git/qemu.git","events":[{"introduced":"0e042025b9fe262316f29e4b8ec47f0b85c24e5f"}]}],"versions":["v6.2.0","v6.2.0-rc0","v6.2.0-rc1","v6.2.0-rc3","v6.2.0-rc4","v7.0.0","v7.0.0-rc0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v7.2.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v7.2.1","v8.0.0-rc3","v8.0.0-rc4","v8.0.0","v7.2.2","v7.2.3","v8.0.1","v8.0.2","v7.2.4","v8.0.3","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v7.2.5","v8.0.4","v8.1.0-rc3","v8.1.0-rc4","v8.1.0","v7.2.6","v8.0.5","v8.1.1","v8.1.2","v8.2.0-rc0","v7.2.7","v8.1.3","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v8.2.0","v7.2.8","v8.1.4","v7.2.9","v8.1.5","v8.2.1","v7.2.10","v8.2.2","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v7.2.11","v8.2.3","v9.0.0","v8.2.4","v7.2.12","v8.2.5","v9.0.1","v7.2.13","v8.2.6","v9.0.2","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.1.0","v7.2.14","v8.2.7","v9.0.3","v9.1.1","v9.2.0-rc0","v7.2.15","v8.2.8","v9.0.4","v9.1.2","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3","v9.2.0","v7.2.16","v8.2.9","v9.1.3","v9.2.1","v9.2.2","v10.0.0-rc0","v10.0.0-rc1","v7.2.17","v8.2.10","v9.2.3","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v10.0.0","v10.0.1","v7.2.18","v9.2.4","v10.0.2","v10.0.3","v10.1.0-rc0","v7.2.19","v10.0.4","v10.1.0","v10.1.0-rc1","v10.1.0-rc2","v10.1.0-rc3","v10.1.0-rc4","v7.2.20","v10.0.5","v10.1.1","v7.2.21","v10.0.6","v10.1.2","v10.2.0-rc1","v10.2.0-rc2","v10.0.7","v10.1.3","v7.2.22","v10.2.0-rc3","v10.2.0-rc4","v10.2.0","v10.0.8","v10.1.4","v10.2.1","v10.0.9","v10.1.5","v10.2.2","v11.0.0-rc0","v11.0.0-rc1","v11.0.0-rc2","v11.0.0-rc3","v11.0.0-rc4","v11.0.0","v10.0.10","v10.2.3","v11.0.1","v10.0.11","v10.2.4","v11.0.2","v10.0.12","v11.0.3","v11.1.0-rc0","v11.1.0-rc1","v11.1.0-rc2","v11.1.0-rc3","v11.1.0","v10.0.13","v11.0.4","v11.1.1","v10.0.14","v11.0.5","v11.1.2","v10.0.15","v11.1.3","v11.2.0-rc0","v6.2.0-rc2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qemu/OSV-2022-581.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49086"}]}
data/OSS-Fuzz/OSV-2022-608.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.1","id":"OSV-2022-608","published":"2022-07-21T00:01:50.967627Z","modified":"2026-10-19T14:36:05.338864Z","summary":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-608.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277"}]}
{"schema_version":"1.9.2","id":"OSV-2022-608","published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-11T14:30:03.783789743Z","summary":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-608.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277"}]}
data/OSS-Fuzz/OSV-2022-653.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2022-725.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.1","id":"OSV-2022-725","published":"2022-08-18T00:01:05.918943Z","modified":"2026-10-19T14:39:23.329486Z","summary":"Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\njxl::N_EMU128::WriteToU8Stage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"a50e71631cabfbdd57d540ba080ecec19b4664af"}]}],"versions":["v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-725.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295"}]}
{"schema_version":"1.9.2","id":"OSV-2022-725","published":"2022-08-18T00:01:05.918943Z","modified":"2026-11-11T14:30:03.783986990Z","summary":"Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\njxl::N_EMU128::WriteToU8Stage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"a50e71631cabfbdd57d540ba080ecec19b4664af"}]}],"versions":["v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-725.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295"}]}
data/OSS-Fuzz/OSV-2023-1350.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2023-1350","published":"2023-12-23T00:12:38.562149Z","modified":"2026-11-09T14:30:05.750542198Z","summary":"Heap-buffer-overflow in inflate","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ninflate\nuncompress2\nuncompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"e6035df1d3f285af9a2e756fb428633eb7898881"}]}],"versions":["v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-1350.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236"}]}
{"schema_version":"1.9.2","id":"OSV-2023-1350","published":"2023-12-23T00:12:38.562149Z","modified":"2026-11-11T14:45:02.966375985Z","summary":"Heap-buffer-overflow in inflate","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ninflate\nuncompress2\nuncompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"e6035df1d3f285af9a2e756fb428633eb7898881"}]}],"versions":["v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-1350.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236"}]}
data/OSS-Fuzz/OSV-2023-307.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/OSS-Fuzz/OSV-2023-319.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2023-319","published":"2023-04-16T14:01:58.406534Z","modified":"2026-11-09T14:30:05.562634892Z","summary":"Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\nZSTD_decompressSequencesLong_bmi2\nZSTD_decompressSequencesLong\nZSTD_decompressBlock_internal\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-319.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035"}]}
{"schema_version":"1.9.2","id":"OSV-2023-319","published":"2023-04-16T14:01:58.406534Z","modified":"2026-11-11T14:45:03.997155309Z","summary":"Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\nZSTD_decompressSequencesLong_bmi2\nZSTD_decompressSequencesLong\nZSTD_decompressBlock_internal\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-319.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035"}]}
data/OSS-Fuzz/OSV-2023-390.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2023-390","published":"2023-05-12T14:00:08.854823Z","modified":"2026-10-28T18:00:04.475452004Z","summary":"Heap-buffer-overflow in sdhci_write","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\nsdhci_write\nmemory_region_write_accessor\nmemory_region_dispatch_write\n```\n","affected":[{"package":{"name":"qemu","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qemu"},"ranges":[{"type":"GIT","repo":"https://git.qemu.org/git/qemu.git","events":[{"introduced":"b7a3a705b644495b7b578e94e0e9dedf93c4f661"}]}],"versions":["v7.0.0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.2.0","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v8.0.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v8.0.0-rc3","v8.0.0-rc4","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v8.1.0-rc3","v8.1.0-rc4","v8.1.0","v7.2.6","v8.0.5","v8.1.1","v8.1.2","v8.2.0-rc0","v7.2.7","v8.1.3","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v8.2.0","v7.2.8","v8.1.4","v7.2.9","v8.1.5","v8.2.1","v7.2.10","v8.2.2","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v7.2.11","v8.2.3","v9.0.0","v8.2.4","v7.2.12","v8.2.5","v9.0.1","v7.2.13","v8.2.6","v9.0.2","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.1.0","v7.2.14","v8.2.7","v9.0.3","v9.1.1","v9.2.0-rc0","v7.2.15","v8.2.8","v9.0.4","v9.1.2","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3","v9.2.0","v7.2.16","v8.2.9","v9.1.3","v9.2.1","v9.2.2","v10.0.0-rc0","v10.0.0-rc1","v7.2.17","v8.2.10","v9.2.3","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v10.0.0","v10.0.1","v7.2.18","v9.2.4","v10.0.2","v10.0.3","v10.1.0-rc0","v7.2.19","v10.0.4","v10.1.0","v10.1.0-rc1","v10.1.0-rc2","v10.1.0-rc3","v10.1.0-rc4","v7.2.20","v10.0.5","v10.1.1","v7.2.21","v10.0.6","v10.1.2","v10.2.0-rc1","v10.2.0-rc2","v10.0.7","v10.1.3","v7.2.22","v10.2.0-rc3","v10.2.0-rc4","v10.2.0","v10.0.8","v10.1.4","v10.2.1","v10.0.9","v10.1.5","v10.2.2","v11.0.0-rc0","v11.0.0-rc1","v11.0.0-rc2","v11.0.0-rc3","v11.0.0-rc4","v11.0.0","v10.0.10","v10.2.3","v11.0.1","v10.0.11","v10.2.4","v11.0.2","v10.0.12","v11.0.3","v11.1.0-rc0","v11.1.0-rc1","v11.1.0-rc2","v11.1.0-rc3","v11.1.0","v10.0.13","v11.0.4","v11.1.1","v10.0.14","v11.0.5","v11.1.2","v10.0.15","v11.1.3"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qemu/OSV-2023-390.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813"}]}
{"schema_version":"1.9.2","id":"OSV-2023-390","published":"2023-05-12T14:00:08.854823Z","modified":"2026-11-11T15:15:02.464482268Z","summary":"Heap-buffer-overflow in sdhci_write","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\nsdhci_write\nmemory_region_write_accessor\nmemory_region_dispatch_write\n```\n","affected":[{"package":{"name":"qemu","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qemu"},"ranges":[{"type":"GIT","repo":"https://git.qemu.org/git/qemu.git","events":[{"introduced":"b7a3a705b644495b7b578e94e0e9dedf93c4f661"}]}],"versions":["v7.0.0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.2.0","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v8.0.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v8.0.0-rc3","v8.0.0-rc4","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.1.0-rc0","v8.1.0-rc1","v8.1.0-rc2","v8.1.0-rc3","v8.1.0-rc4","v8.1.0","v7.2.6","v8.0.5","v8.1.1","v8.1.2","v8.2.0-rc0","v7.2.7","v8.1.3","v8.2.0-rc1","v8.2.0-rc2","v8.2.0-rc3","v8.2.0-rc4","v8.2.0","v7.2.8","v8.1.4","v7.2.9","v8.1.5","v8.2.1","v7.2.10","v8.2.2","v9.0.0-rc0","v9.0.0-rc1","v9.0.0-rc2","v9.0.0-rc3","v9.0.0-rc4","v7.2.11","v8.2.3","v9.0.0","v8.2.4","v7.2.12","v8.2.5","v9.0.1","v7.2.13","v8.2.6","v9.0.2","v9.1.0-rc0","v9.1.0-rc1","v9.1.0-rc2","v9.1.0-rc3","v9.1.0-rc4","v9.1.0","v7.2.14","v8.2.7","v9.0.3","v9.1.1","v9.2.0-rc0","v7.2.15","v8.2.8","v9.0.4","v9.1.2","v9.2.0-rc1","v9.2.0-rc2","v9.2.0-rc3","v9.2.0","v7.2.16","v8.2.9","v9.1.3","v9.2.1","v9.2.2","v10.0.0-rc0","v10.0.0-rc1","v7.2.17","v8.2.10","v9.2.3","v10.0.0-rc2","v10.0.0-rc3","v10.0.0-rc4","v10.0.0","v10.0.1","v7.2.18","v9.2.4","v10.0.2","v10.0.3","v10.1.0-rc0","v7.2.19","v10.0.4","v10.1.0","v10.1.0-rc1","v10.1.0-rc2","v10.1.0-rc3","v10.1.0-rc4","v7.2.20","v10.0.5","v10.1.1","v7.2.21","v10.0.6","v10.1.2","v10.2.0-rc1","v10.2.0-rc2","v10.0.7","v10.1.3","v7.2.22","v10.2.0-rc3","v10.2.0-rc4","v10.2.0","v10.0.8","v10.1.4","v10.2.1","v10.0.9","v10.1.5","v10.2.2","v11.0.0-rc0","v11.0.0-rc1","v11.0.0-rc2","v11.0.0-rc3","v11.0.0-rc4","v11.0.0","v10.0.10","v10.2.3","v11.0.1","v10.0.11","v10.2.4","v11.0.2","v10.0.12","v11.0.3","v11.1.0-rc0","v11.1.0-rc1","v11.1.0-rc2","v11.1.0-rc3","v11.1.0","v10.0.13","v11.0.4","v11.1.1","v10.0.14","v11.0.5","v11.1.2","v10.0.15","v11.1.3","v11.2.0-rc0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qemu/OSV-2023-390.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813"}]}
data/OSS-Fuzz/OSV-2023-606.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2023-606","published":"2023-07-23T14:01:02.159160Z","modified":"2026-11-09T14:45:02.591999133Z","summary":"Heap-buffer-overflow in ZSTD_decompressMultiFrame","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nZSTD_decompressMultiFrame\nZSTD_decompress_usingDDict\nzstd_wrap_decompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-606.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778"}]}
{"schema_version":"1.9.2","id":"OSV-2023-606","published":"2023-07-23T14:01:02.159160Z","modified":"2026-11-11T14:45:02.976646279Z","summary":"Heap-buffer-overflow in ZSTD_decompressMultiFrame","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nZSTD_decompressMultiFrame\nZSTD_decompress_usingDDict\nzstd_wrap_decompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-606.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778"}]}
data/OSS-Fuzz/OSV-2024-914.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.1","id":"OSV-2024-914","published":"2024-08-16T00:08:20.277708Z","modified":"2026-10-19T15:13:03.724140Z","summary":"UNKNOWN READ in boost::re_detail_500::basic_regex_formatter<std::__1::ostream_iterator<char, cha","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66851\n\n```\nCrash type: UNKNOWN READ\nCrash state:\nboost::re_detail_500::basic_regex_formatter<std::__1::ostream_iterator<char, cha\nboost::re_detail_500::basic_regex_formatter<std::__1::ostream_iterator<char, cha\nstd::__1::ostream_iterator<char, char, std::__1::char_traits<char> > boost::re_d\n```\n","affected":[{"package":{"name":"boost","ecosystem":"OSS-Fuzz","purl":"pkg:generic/boost"},"ranges":[{"type":"GIT","repo":"https://github.com/boostorg/boost.git","events":[{"introduced":"9072bfc2d969ca1e8c49651232817201e05e3eae"},{"introduced":"206cf016ae9454ed65e9c5faf4a322f31444fb80"}]}],"versions":["boost-1.85.0","boost-1.85.0.beta1","boost-1.86.0","boost-1.86.0.beta1","boost-1.87.0.beta1","boost-1.87.0","boost-1.88.0.beta1","boost-1.88.0","boost-1.89.0.beta1","boost-1.89.0","boost-1.90.0.beta1","boost-1.90.0","boost-1.91.0.beta1","boost-1.91.0","boost-1.91.0-1","boost-1.92.0.beta1","boost-1.92.0"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"0251e5fa19564439f3d654df8d4de1abdbaa72b2:9f83dd55ea67f1bab62c20d29bc5527345aafc55","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/boost/OSV-2024-914.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66851"}]}
{"schema_version":"1.9.2","id":"OSV-2024-914","published":"2024-08-16T00:08:20.277708Z","modified":"2026-11-11T14:45:03.240800794Z","summary":"UNKNOWN READ in boost::re_detail_500::basic_regex_formatter<std::__1::ostream_iterator<char, cha","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66851\n\n```\nCrash type: UNKNOWN READ\nCrash state:\nboost::re_detail_500::basic_regex_formatter<std::__1::ostream_iterator<char, cha\nboost::re_detail_500::basic_regex_formatter<std::__1::ostream_iterator<char, cha\nstd::__1::ostream_iterator<char, char, std::__1::char_traits<char> > boost::re_d\n```\n","affected":[{"package":{"name":"boost","ecosystem":"OSS-Fuzz","purl":"pkg:generic/boost"},"ranges":[{"type":"GIT","repo":"https://github.com/boostorg/boost.git","events":[{"introduced":"9072bfc2d969ca1e8c49651232817201e05e3eae"},{"introduced":"206cf016ae9454ed65e9c5faf4a322f31444fb80"}]}],"versions":["boost-1.85.0","boost-1.85.0.beta1","boost-1.86.0","boost-1.86.0.beta1","boost-1.87.0.beta1","boost-1.87.0","boost-1.88.0.beta1","boost-1.88.0","boost-1.89.0.beta1","boost-1.89.0","boost-1.90.0.beta1","boost-1.90.0","boost-1.91.0.beta1","boost-1.91.0","boost-1.91.0-1","boost-1.92.0.beta1","boost-1.92.0","boost-1.93.0.beta1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"0251e5fa19564439f3d654df8d4de1abdbaa72b2:9f83dd55ea67f1bab62c20d29bc5527345aafc55","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/boost/OSV-2024-914.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66851"}]}
data/OSS-Fuzz/OSV-2026-1077.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.0","id":"OSV-2026-1077","published":"2026-07-28T07:23:02.143330Z","modified":"2026-10-20T12:16:28.898889323Z","summary":"Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=536937906\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nstd::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch\nAssimp::XFileParser::GetNextToken\nAssimp::XFileParser::ParseDataObjectTemplate\n```\n","affected":[{"package":{"name":"assimp","ecosystem":"OSS-Fuzz","purl":"pkg:generic/assimp"},"ranges":[{"type":"GIT","repo":"https://github.com/assimp/assimp.git","events":[{"introduced":"16c50d7b53b5b6536599135004fb003c5e6f88b8"}]}],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"e86df1f8b139f4095653d37dc08622fa5d206663:e2fd15f8f78d99e08fd3d3f90d7add3bf310b122","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2026-1077.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=536937906"}]}
{"schema_version":"1.9.2","id":"OSV-2026-1077","published":"2026-07-28T07:23:02.143330Z","modified":"2026-11-11T14:45:04.509743325Z","summary":"Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=536937906\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nstd::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch\nAssimp::XFileParser::GetNextToken\nAssimp::XFileParser::ParseDataObjectTemplate\n```\n","affected":[{"package":{"name":"assimp","ecosystem":"OSS-Fuzz","purl":"pkg:generic/assimp"},"ranges":[{"type":"GIT","repo":"https://github.com/assimp/assimp.git","events":[{"introduced":"16c50d7b53b5b6536599135004fb003c5e6f88b8"}]}],"versions":["v6.0.6"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"e86df1f8b139f4095653d37dc08622fa5d206663:e2fd15f8f78d99e08fd3d3f90d7add3bf310b122","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2026-1077.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=536937906"}]}
data/OSS-Fuzz/OSV-2026-1113.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"OSV-2026-1113","published":"2026-08-04T00:18:00.468256Z","modified":"2026-11-03T12:15:03.307036132Z","summary":"Heap-buffer-overflow in Assimp::MD5::MD5MeshParser::MD5MeshParser","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541854675\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nAssimp::MD5::MD5MeshParser::MD5MeshParser\nAssimp::MD5Importer::LoadMD5MeshFile\nAssimp::MD5Importer::InternReadFile\n```\n","affected":[{"package":{"name":"assimp","ecosystem":"OSS-Fuzz","purl":"pkg:generic/assimp"},"ranges":[{"type":"GIT","repo":"https://github.com/assimp/assimp.git","events":[{"introduced":"16c50d7b53b5b6536599135004fb003c5e6f88b8"}]}],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"e86df1f8b139f4095653d37dc08622fa5d206663:e2fd15f8f78d99e08fd3d3f90d7add3bf310b122","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2026-1113.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541854675"}]}
{"schema_version":"1.9.2","id":"OSV-2026-1113","published":"2026-08-04T00:18:00.468256Z","modified":"2026-11-11T14:45:04.509744594Z","summary":"Heap-buffer-overflow in Assimp::MD5::MD5MeshParser::MD5MeshParser","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541854675\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nAssimp::MD5::MD5MeshParser::MD5MeshParser\nAssimp::MD5Importer::LoadMD5MeshFile\nAssimp::MD5Importer::InternReadFile\n```\n","affected":[{"package":{"name":"assimp","ecosystem":"OSS-Fuzz","purl":"pkg:generic/assimp"},"ranges":[{"type":"GIT","repo":"https://github.com/assimp/assimp.git","events":[{"introduced":"16c50d7b53b5b6536599135004fb003c5e6f88b8"}]}],"versions":["v6.0.6"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"e86df1f8b139f4095653d37dc08622fa5d206663:e2fd15f8f78d99e08fd3d3f90d7add3bf310b122","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2026-1113.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541854675"}]}
data/OSS-Fuzz/OSV-2026-1163.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"OSV-2026-1163","published":"2026-08-18T00:09:53.881687Z","modified":"2026-11-11T17:23:28.352446925Z","summary":"Use-of-uninitialized-value in processGSV","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=547003490\n\n```\nCrash type: Use-of-uninitialized-value\nCrash state:\nprocessGSV\nnmea_parse\ngeneric_parse_input\n```\n","affected":[{"package":{"name":"gpsd","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpsd"},"ranges":[{"type":"GIT","repo":"https://gitlab.com/gpsd/gpsd","events":[{"introduced":"69b540acdcb5a83959d0702f53b38eef26e08e07"},{"fixed":"3aafa6974e537e1af24788d3a2766faf3c874b64"}]}],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpsd/OSV-2026-1163.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=547003490"}]}
data/npm/MAL-2026-10438.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.7.5","id":"MAL-2026-10438","published":"2026-07-13T09:22:42Z","modified":"2026-07-13T10:47:05.998835027Z","summary":"Malicious code in netspeedutil (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1)\nOn install, setup.js walks up to the installer's project tree and scans image files for a '__STEG__' marker. When found, it AES-256-CBC-decrypts an embedded steganographic payload that points to a file inside the installer's node_modules and uses a regex (`cli.command(\"build [root]\"...finally{...}`) to patch that third-party CLI's build command, prepending an import of netspeedutil/inject.js and an `await inject()` call inside the build's finally block. Once tampered, every subsequent project build runs inject.js, which uses javascript-obfuscator (control-flow flattening, dead-code injection, base64 string-array encoding) to embed an obfuscated client into dist/index.html. That client opens a WebRTC TURN connection to a hardcoded attacker host at 13.234.111.178:3478 as a covert C2 / signaling channel and renders attacker-supplied DOM content to end users of any site the developer ships. The package's stated purpose ('Fast string matching and pattern validation utilities') is a cover story unrelated to the actual code. This is a build-pipeline supply-chain compromise: the installer's production artifacts are silently weaponized against their own end users.\n","affected":[{"package":{"name":"netspeedutil","ecosystem":"npm","purl":"pkg:npm/netspeedutil"},"versions":["1.0.13"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"7efde05d8f284658812cf01c6081f0e4495839048f1f8f6ce4048cdb1deced49","tlsh":"bb6174c466fa232643a2327bf15b440ab369f4023609d694fa1cdb147f47174e9e36d9"},{"path":"inject.js","sha256":"01a8d0caa80766a19edd7f016a2dd6c2d89a7d6815a3f7566681ebe2ec3419a0","tlsh":"d0d1c685bcf32190426360bad27fd10a6232e5433509d9587f8cda519f9871cadb77dc"},{"path":"package.json","sha256":"42857935f9c782d95b778fa65b7bb0e29849a57bc92a163469bec277c09fbedb","tlsh":"9dd0c2208c21ea6326c926950479c4436ab24c1b0204ac6c97c310a8868e3ff59be30e"}],"package_integrity":[{"filename":"netspeedutil-1.0.13.tgz","hashes":{"sha1":"d98c7d0d3c8da0118074c9d95cb6e8e946f2c53b","sha512_sri":"sha512-CJs9D8nxvXMTYdEjwFJzOwXynDYXIwmwu4MJPVJqnSUy/xftPZ300fVhaKCb2FiCvzWqRh4Q3I8QzyONZsWAkQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/netspeedutil/MAL-2026-10438.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/netspeedutil/v/1.0.13"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010209","import_time":"2026-07-13T10:37:37.939109253Z","modified_time":"2026-07-13T09:22:42Z","sha256":"e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1","source":"amazon-inspector","versions":["1.0.13"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
{"schema_version":"1.9.2","id":"MAL-2026-10438","published":"2026-07-13T09:22:42Z","modified":"2026-11-11T16:31:43.857272084Z","aliases":["GHSA-pv54-r48f-chvp"],"summary":"Malicious code in netspeedutil (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1)\nOn install, setup.js walks up to the installer's project tree and scans image files for a '__STEG__' marker. When found, it AES-256-CBC-decrypts an embedded steganographic payload that points to a file inside the installer's node_modules and uses a regex (`cli.command(\"build [root]\"...finally{...}`) to patch that third-party CLI's build command, prepending an import of netspeedutil/inject.js and an `await inject()` call inside the build's finally block. Once tampered, every subsequent project build runs inject.js, which uses javascript-obfuscator (control-flow flattening, dead-code injection, base64 string-array encoding) to embed an obfuscated client into dist/index.html. That client opens a WebRTC TURN connection to a hardcoded attacker host at 13.234.111.178:3478 as a covert C2 / signaling channel and renders attacker-supplied DOM content to end users of any site the developer ships. The package's stated purpose ('Fast string matching and pattern validation utilities') is a cover story unrelated to the actual code. This is a build-pipeline supply-chain compromise: the installer's production artifacts are silently weaponized against their own end users.\n\n## Source: ghsa-malware (2389b90e574f057509766a600f3be29adddcf1b4185c6696122fdb3bf285428b)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"netspeedutil","ecosystem":"npm","purl":"pkg:npm/netspeedutil"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.13"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"7efde05d8f284658812cf01c6081f0e4495839048f1f8f6ce4048cdb1deced49","tlsh":"bb6174c466fa232643a2327bf15b440ab369f4023609d694fa1cdb147f47174e9e36d9"},{"path":"inject.js","sha256":"01a8d0caa80766a19edd7f016a2dd6c2d89a7d6815a3f7566681ebe2ec3419a0","tlsh":"d0d1c685bcf32190426360bad27fd10a6232e5433509d9587f8cda519f9871cadb77dc"},{"path":"package.json","sha256":"42857935f9c782d95b778fa65b7bb0e29849a57bc92a163469bec277c09fbedb","tlsh":"9dd0c2208c21ea6326c926950479c4436ab24c1b0204ac6c97c310a8868e3ff59be30e"}],"package_integrity":[{"filename":"netspeedutil-1.0.13.tgz","hashes":{"sha1":"d98c7d0d3c8da0118074c9d95cb6e8e946f2c53b","sha512_sri":"sha512-CJs9D8nxvXMTYdEjwFJzOwXynDYXIwmwu4MJPVJqnSUy/xftPZ300fVhaKCb2FiCvzWqRh4Q3I8QzyONZsWAkQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/netspeedutil/MAL-2026-10438.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/netspeedutil/v/1.0.13"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pv54-r48f-chvp"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010209","import_time":"2026-07-13T10:37:37.939109253Z","modified_time":"2026-07-13T09:22:42Z","sha256":"e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1","source":"amazon-inspector","versions":["1.0.13"]},{"id":"GHSA-pv54-r48f-chvp","import_time":"2026-11-11T16:18:54.774756894Z","modified_time":"2026-11-11T16:14:30Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"2389b90e574f057509766a600f3be29adddcf1b4185c6696122fdb3bf285428b","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
data/npm/MAL-2026-10687.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/npm/MAL-2026-11205.json
+1 -1
View File
File diff suppressed because one or more lines are too long
data/npm/MAL-2026-16053.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.0","id":"MAL-2026-16053","published":"2026-09-09T00:27:12Z","modified":"2026-09-09T01:00:05.002081678Z","summary":"Malicious code in file-type-detector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72)\nA clone of file-type-checker with one function added: isSign(name, moduleName, offset) in dist/validation/image.js reads public/${name}.png from the working directory, splits the buffer at -offset, and writes the trailing payload to../../../{moduleName}/log - a sibling package under node_modules - then returns isPNG() so the caller sees a plausible boolean. It is undocumented, reachable only via an __exportStar wildcard so it is never named in dist/index.js, and fails silently on try/catch.\n\nDrop stage of a three-package chain: file-type-detector writes the payload, gloggo (1.1.2-1.1.4) executes it via require('./log'), and sonmors (typosquat of sonner) triggers the chain by requiring gloggo. gloggo shares the npm publisher log-developer and was published five minutes apart on 2026-08-27. No install hooks; execution occurs on require().\n","affected":[{"package":{"name":"file-type-detector","ecosystem":"npm","purl":"pkg:npm/file-type-detector"},"versions":["1.1.0","1.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"file-type-detector-1.1.0.tgz","hashes":{"sha1":"c3452c877f280788620ba728592d5dac71c2958d","sha512_sri":"sha512-xrefg9CLEpfg+lb5YVdyFHlsV/ZF8Xrt+MsYSAkj38bJmbZ28a3ZgBP0ETKAIs6AQOMgqGp2WHIPpwhLGjapAw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/file-type-detector/MAL-2026-16053.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/file-type-detector/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/file-type-detector/v/1.1.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019729","import_time":"2026-09-09T00:47:58.112210798Z","modified_time":"2026-09-09T00:27:12Z","sha256":"04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-019730","import_time":"2026-09-09T00:47:58.190429304Z","modified_time":"2026-09-09T00:27:22Z","sha256":"71bc73a30f67553cd6a23058191a0e93333a056cbcb85896fbfc87b2e3a4e477","source":"amazon-inspector","versions":["1.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
{"schema_version":"1.9.2","id":"MAL-2026-16053","published":"2026-09-09T00:27:12Z","modified":"2026-11-11T16:31:43.815376434Z","aliases":["GHSA-fw6v-88vw-pqr3"],"summary":"Malicious code in file-type-detector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72)\nA clone of file-type-checker with one function added: isSign(name, moduleName, offset) in dist/validation/image.js reads public/${name}.png from the working directory, splits the buffer at -offset, and writes the trailing payload to../../../{moduleName}/log - a sibling package under node_modules - then returns isPNG() so the caller sees a plausible boolean. It is undocumented, reachable only via an __exportStar wildcard so it is never named in dist/index.js, and fails silently on try/catch.\n\nDrop stage of a three-package chain: file-type-detector writes the payload, gloggo (1.1.2-1.1.4) executes it via require('./log'), and sonmors (typosquat of sonner) triggers the chain by requiring gloggo. gloggo shares the npm publisher log-developer and was published five minutes apart on 2026-08-27. No install hooks; execution occurs on require().\n\n## Source: ghsa-malware (cf4b330143b17fd8c5b2c9b3ea655e4d8ab79266aa54faefc66369c49343d020)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"file-type-detector","ecosystem":"npm","purl":"pkg:npm/file-type-detector"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0","1.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"file-type-detector-1.1.0.tgz","hashes":{"sha1":"c3452c877f280788620ba728592d5dac71c2958d","sha512_sri":"sha512-xrefg9CLEpfg+lb5YVdyFHlsV/ZF8Xrt+MsYSAkj38bJmbZ28a3ZgBP0ETKAIs6AQOMgqGp2WHIPpwhLGjapAw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/file-type-detector/MAL-2026-16053.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/file-type-detector/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/file-type-detector/v/1.1.1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fw6v-88vw-pqr3"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019729","import_time":"2026-09-09T00:47:58.112210798Z","modified_time":"2026-09-09T00:27:12Z","sha256":"04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-019730","import_time":"2026-09-09T00:47:58.190429304Z","modified_time":"2026-09-09T00:27:22Z","sha256":"71bc73a30f67553cd6a23058191a0e93333a056cbcb85896fbfc87b2e3a4e477","source":"amazon-inspector","versions":["1.1.1"]},{"id":"GHSA-fw6v-88vw-pqr3","import_time":"2026-11-11T16:18:54.765865808Z","modified_time":"2026-11-11T16:07:40Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"cf4b330143b17fd8c5b2c9b3ea655e4d8ab79266aa54faefc66369c49343d020","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
data/npm/MAL-2026-16054.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.0","id":"MAL-2026-16054","published":"2026-09-09T00:16:27Z","modified":"2026-09-09T01:00:04.992786283Z","summary":"Malicious code in gloggo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d)\ngloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text (attributed to Blaine Bublitz), while package.json attributes authorship to 'Blockvora Team <team@blockvora.com>' with repository 'blockvora/gloggo'. The package name is a one-character variant of 'glogg'. getLogger() invokes isSign('favorite','gloggo',12467) from the dependency 'file-type-detector' and, when that gate returns truthy, executes require('./log'). The './log' module is not present in the tarball, so its bytes must be produced or supplied at require time by the dependency. A logging utility has no legitimate reason to gate its loader on an opaque file-signature check from an unrelated third-party dependency, and the gated path executes code that is not part of the shipped package contents. Consumers who install gloggo believing it to be glogg import a typosquat that conditionally runs code sourced from a suspicious sibling dependency when the module is required.\n","affected":[{"package":{"name":"gloggo","ecosystem":"npm","purl":"pkg:npm/gloggo"},"versions":["1.1.3","1.1.4","1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"244f714c904187298d10bbef8a6df888097f7090aa8949f8c87b836549e333bd","tlsh":"8c21ee765af6b1536d3b74a5960e670235b9c0d7401ceb4139ece3812f68c380b76bd8"},{"path":"package.json","sha256":"74aeaf049db1e557f320a380b3d7a78ab3dee9b13cafde57a04e6241290b3814","tlsh":"3b110611ce789ca342d8a2ae781e02c265755d9348c9fd0cb79a530c0f5e52f64fd5ac"}],"package_integrity":[{"filename":"gloggo-1.1.3.tgz","hashes":{"sha1":"28199903616edb2524c2e305f055bced94a2f791","sha512_sri":"sha512-bgoTi37QcXFMtf6kmmq8SOJNPONIFVc1QJw2HiVG5A4l7zxBsoJ8zM2yKdML4tBZ/gnZFjNBhyCSyRPU25xRBg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gloggo/MAL-2026-16054.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gloggo/v/1.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gloggo/v/1.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gloggo/v/1.1.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019727","import_time":"2026-09-09T00:47:57.934844705Z","modified_time":"2026-09-09T00:16:34Z","sha256":"4b6a7344a560f0fa4e00d334efef568cd34c3800101315a95f647dabc8285fb1","source":"amazon-inspector","versions":["1.1.3"]},{"id":"IN-MAL-2026-019726","import_time":"2026-09-09T00:47:57.874027179Z","modified_time":"2026-09-09T00:16:27Z","sha256":"6bacf73012ce6ed828bddaf332d26ae8289b5585ea886cfc85852ac0d647282e","source":"amazon-inspector","versions":["1.1.4"]},{"id":"IN-MAL-2026-019728","import_time":"2026-09-09T00:47:58.012084713Z","modified_time":"2026-09-09T00:16:41Z","sha256":"a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d","source":"amazon-inspector","versions":["1.1.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
{"schema_version":"1.9.2","id":"MAL-2026-16054","published":"2026-09-09T00:16:27Z","modified":"2026-11-11T16:31:43.383626617Z","aliases":["GHSA-pxm8-xf8x-r9mj"],"summary":"Malicious code in gloggo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d)\ngloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text (attributed to Blaine Bublitz), while package.json attributes authorship to 'Blockvora Team <team@blockvora.com>' with repository 'blockvora/gloggo'. The package name is a one-character variant of 'glogg'. getLogger() invokes isSign('favorite','gloggo',12467) from the dependency 'file-type-detector' and, when that gate returns truthy, executes require('./log'). The './log' module is not present in the tarball, so its bytes must be produced or supplied at require time by the dependency. A logging utility has no legitimate reason to gate its loader on an opaque file-signature check from an unrelated third-party dependency, and the gated path executes code that is not part of the shipped package contents. Consumers who install gloggo believing it to be glogg import a typosquat that conditionally runs code sourced from a suspicious sibling dependency when the module is required.\n\n## Source: ghsa-malware (4f6786e47a7ec7789612992189f5ba8613d0b1c39a200b5a8b07ac2badf3a5df)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"gloggo","ecosystem":"npm","purl":"pkg:npm/gloggo"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.3","1.1.4","1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"244f714c904187298d10bbef8a6df888097f7090aa8949f8c87b836549e333bd","tlsh":"8c21ee765af6b1536d3b74a5960e670235b9c0d7401ceb4139ece3812f68c380b76bd8"},{"path":"package.json","sha256":"74aeaf049db1e557f320a380b3d7a78ab3dee9b13cafde57a04e6241290b3814","tlsh":"3b110611ce789ca342d8a2ae781e02c265755d9348c9fd0cb79a530c0f5e52f64fd5ac"}],"package_integrity":[{"filename":"gloggo-1.1.3.tgz","hashes":{"sha1":"28199903616edb2524c2e305f055bced94a2f791","sha512_sri":"sha512-bgoTi37QcXFMtf6kmmq8SOJNPONIFVc1QJw2HiVG5A4l7zxBsoJ8zM2yKdML4tBZ/gnZFjNBhyCSyRPU25xRBg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gloggo/MAL-2026-16054.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gloggo/v/1.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gloggo/v/1.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gloggo/v/1.1.2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pxm8-xf8x-r9mj"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019727","import_time":"2026-09-09T00:47:57.934844705Z","modified_time":"2026-09-09T00:16:34Z","sha256":"4b6a7344a560f0fa4e00d334efef568cd34c3800101315a95f647dabc8285fb1","source":"amazon-inspector","versions":["1.1.3"]},{"id":"IN-MAL-2026-019726","import_time":"2026-09-09T00:47:57.874027179Z","modified_time":"2026-09-09T00:16:27Z","sha256":"6bacf73012ce6ed828bddaf332d26ae8289b5585ea886cfc85852ac0d647282e","source":"amazon-inspector","versions":["1.1.4"]},{"id":"IN-MAL-2026-019728","import_time":"2026-09-09T00:47:58.012084713Z","modified_time":"2026-09-09T00:16:41Z","sha256":"a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d","source":"amazon-inspector","versions":["1.1.2"]},{"id":"GHSA-pxm8-xf8x-r9mj","import_time":"2026-11-11T16:18:54.775868005Z","modified_time":"2026-11-11T16:07:47Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"4f6786e47a7ec7789612992189f5ba8613d0b1c39a200b5a8b07ac2badf3a5df","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
data/npm/MAL-2026-16069.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.0","id":"MAL-2026-16069","published":"2026-09-09T04:04:10Z","modified":"2026-09-09T04:30:06.402432623Z","summary":"Malicious code in reactlogo-load (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f)\nThe package presents itself as a logo/color utility but its exported loadLogo() function extracts a URL from LSB-encoded bits of a PNG, fetches the response body, and executes it via a reflective Function-constructor invocation. The 'constructor' property name and the Function reference are hidden behind a deterministic string-shuffle helper (hsvMean) named as a color utility, so no plaintext 'constructor', 'Function', 'eval', or destination URL appears in the source. runInContext binds global.require, module, and exports into the executed script, giving the fetched code full Node runtime capability on the caller's host. Following the README's documented usage (vite/tailwind build integration) triggers the fetch-and-execute path, so arbitrary attacker-controlled code runs on any machine that adopts this library.\n","affected":[{"package":{"name":"reactlogo-load","ecosystem":"npm","purl":"pkg:npm/reactlogo-load"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"893a50335df880baa9bc6c8b0bfeef3acda3378fa6966b0f092ddd6a6a6d6cf8","tlsh":"de92956932f7602a4163a0b8451fc81f77296803325fc994fb6c96d03fc92789af3ad5"}],"package_integrity":[{"filename":"reactlogo-load-1.0.0.tgz","hashes":{"sha1":"979bbb0325f4031046b55ff7891939535d4b1e22","sha512_sri":"sha512-DwVU0Bqa7zv8o/qS1fHKLtcz5qa8HIunZwwlHfqTm0CF65oXk37llCPjxbBeHHOuil8O7aJssXn2663nR1Bfkw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/reactlogo-load/MAL-2026-16069.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/reactlogo-load/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019836","import_time":"2026-09-09T04:21:44.902097712Z","modified_time":"2026-09-09T04:04:10Z","sha256":"a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
{"schema_version":"1.9.2","id":"MAL-2026-16069","published":"2026-09-09T04:04:10Z","modified":"2026-11-11T16:31:01.987557807Z","aliases":["GHSA-8wjj-jqj4-3p7j"],"summary":"Malicious code in reactlogo-load (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f)\nThe package presents itself as a logo/color utility but its exported loadLogo() function extracts a URL from LSB-encoded bits of a PNG, fetches the response body, and executes it via a reflective Function-constructor invocation. The 'constructor' property name and the Function reference are hidden behind a deterministic string-shuffle helper (hsvMean) named as a color utility, so no plaintext 'constructor', 'Function', 'eval', or destination URL appears in the source. runInContext binds global.require, module, and exports into the executed script, giving the fetched code full Node runtime capability on the caller's host. Following the README's documented usage (vite/tailwind build integration) triggers the fetch-and-execute path, so arbitrary attacker-controlled code runs on any machine that adopts this library.\n\n## Source: ghsa-malware (b601f039e88a447643c767a9b373a4c29abccb87e1bbfa2ab82e3d8c767b5d56)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"reactlogo-load","ecosystem":"npm","purl":"pkg:npm/reactlogo-load"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"893a50335df880baa9bc6c8b0bfeef3acda3378fa6966b0f092ddd6a6a6d6cf8","tlsh":"de92956932f7602a4163a0b8451fc81f77296803325fc994fb6c96d03fc92789af3ad5"}],"package_integrity":[{"filename":"reactlogo-load-1.0.0.tgz","hashes":{"sha1":"979bbb0325f4031046b55ff7891939535d4b1e22","sha512_sri":"sha512-DwVU0Bqa7zv8o/qS1fHKLtcz5qa8HIunZwwlHfqTm0CF65oXk37llCPjxbBeHHOuil8O7aJssXn2663nR1Bfkw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/reactlogo-load/MAL-2026-16069.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/reactlogo-load/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8wjj-jqj4-3p7j"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019836","import_time":"2026-09-09T04:21:44.902097712Z","modified_time":"2026-09-09T04:04:10Z","sha256":"a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f","source":"amazon-inspector","versions":["1.0.0"]},{"id":"GHSA-8wjj-jqj4-3p7j","import_time":"2026-11-11T16:18:54.763099796Z","modified_time":"2026-11-11T16:05:26Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b601f039e88a447643c767a9b373a4c29abccb87e1bbfa2ab82e3d8c767b5d56","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
data/npm/MAL-2026-16390.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.0","id":"MAL-2026-16390","published":"2026-09-22T18:08:06Z","modified":"2026-09-22T18:45:07.016931857Z","summary":"Malicious code in oracle-redis (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6)\nThe package publishes as `oracle-redis` but ships a verbatim copy of the ioredis README, source tree, and repository URL (`git://github.com/luin/ioredis.git`), presenting itself as ioredis under a different name. The `package.json` declares two additional runtime dependencies that are not part of ioredis's real dependency set and are never imported anywhere in the shipped `built/` source: `redis-type-intel` ^1.10.5 and `pino-ulid` ^2.12.2. Because they are ordinary `dependencies` with caret ranges, `npm install oracle-redis` resolves and installs those two packages (and their transitive graph) into the installer's `node_modules`, executing whatever lifecycle scripts they declare, even though nothing in the ioredis code being wrapped ever loads them. The combination of a name-squat lure over a popular library plus unused, caret-pinned extra dependencies is a dependency-delivery shape: the harm, if any, arrives through the transitive install of the extra names rather than through this tarball's own code.\n","affected":[{"package":{"name":"oracle-redis","ecosystem":"npm","purl":"pkg:npm/oracle-redis"},"versions":["5.11.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e5f763b250baaea3fed9e4d692825e9864526b8ef614339045f47fff50fb3083","tlsh":"da61ff20dd9a9d732ac441f9e8b502819525c40b2e50fc0db3f953ad4f9e6bf31b9a2d"}],"package_integrity":[{"filename":"oracle-redis-5.11.3.tgz","hashes":{"sha1":"81f13d4426d451a25d109ce4833ea809c375523a","sha512_sri":"sha512-4aapEwKGeVugfaSVZW7NQOo36rcIRa+9Tc6EjHtejGyJeHVWOeDaXHgp0WF9NdwqIVI4SiswiRUi3wEy0yCaDQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/oracle-redis/MAL-2026-16390.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/oracle-redis/v/5.11.3"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020298","import_time":"2026-09-22T18:23:45.268002209Z","modified_time":"2026-09-22T18:08:06Z","sha256":"c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6","source":"amazon-inspector","versions":["5.11.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
{"schema_version":"1.9.2","id":"MAL-2026-16390","published":"2026-09-22T18:08:06Z","modified":"2026-11-11T16:31:27.240504300Z","aliases":["GHSA-h224-x97c-j5g7"],"summary":"Malicious code in oracle-redis (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6)\nThe package publishes as `oracle-redis` but ships a verbatim copy of the ioredis README, source tree, and repository URL (`git://github.com/luin/ioredis.git`), presenting itself as ioredis under a different name. The `package.json` declares two additional runtime dependencies that are not part of ioredis's real dependency set and are never imported anywhere in the shipped `built/` source: `redis-type-intel` ^1.10.5 and `pino-ulid` ^2.12.2. Because they are ordinary `dependencies` with caret ranges, `npm install oracle-redis` resolves and installs those two packages (and their transitive graph) into the installer's `node_modules`, executing whatever lifecycle scripts they declare, even though nothing in the ioredis code being wrapped ever loads them. The combination of a name-squat lure over a popular library plus unused, caret-pinned extra dependencies is a dependency-delivery shape: the harm, if any, arrives through the transitive install of the extra names rather than through this tarball's own code.\n\n## Source: ghsa-malware (e9f5baf0796d59298424c73abf874e64aaaf8f447d51fbf147c2327b667847fa)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"oracle-redis","ecosystem":"npm","purl":"pkg:npm/oracle-redis"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["5.11.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e5f763b250baaea3fed9e4d692825e9864526b8ef614339045f47fff50fb3083","tlsh":"da61ff20dd9a9d732ac441f9e8b502819525c40b2e50fc0db3f953ad4f9e6bf31b9a2d"}],"package_integrity":[{"filename":"oracle-redis-5.11.3.tgz","hashes":{"sha1":"81f13d4426d451a25d109ce4833ea809c375523a","sha512_sri":"sha512-4aapEwKGeVugfaSVZW7NQOo36rcIRa+9Tc6EjHtejGyJeHVWOeDaXHgp0WF9NdwqIVI4SiswiRUi3wEy0yCaDQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/oracle-redis/MAL-2026-16390.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/oracle-redis/v/5.11.3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h224-x97c-j5g7"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020298","import_time":"2026-09-22T18:23:45.268002209Z","modified_time":"2026-09-22T18:08:06Z","sha256":"c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6","source":"amazon-inspector","versions":["5.11.3"]},{"id":"GHSA-h224-x97c-j5g7","import_time":"2026-11-11T16:18:54.768278793Z","modified_time":"2026-11-11T15:46:47Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"e9f5baf0796d59298424c73abf874e64aaaf8f447d51fbf147c2327b667847fa","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
data/npm/MAL-2026-19117.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19117","published":"2026-11-11T10:28:56Z","modified":"2026-11-11T17:42:05.733159345Z","aliases":["GHSA-qpc3-24mv-6qrp"],"summary":"Malicious code in xsdsh-purge-next (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b0e622ecd67d042449c9c412990c54fdff64eee5df796a6f33ddf3ea46c8d681)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"xsdsh-purge-next","ecosystem":"npm","purl":"pkg:npm/xsdsh-purge-next"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xsdsh-purge-next/MAL-2026-19117.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qpc3-24mv-6qrp"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-qpc3-24mv-6qrp","import_time":"2026-11-11T11:17:25.735427867Z","modified_time":"2026-11-11T10:28:56Z","sha256":"b0e622ecd67d042449c9c412990c54fdff64eee5df796a6f33ddf3ea46c8d681","source":"ghsa-malware","versions":["1.0.0"]}]}}
data/npm/MAL-2026-19118.json
+1 -1
View File
@@ -1 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19118","published":"2026-11-11T12:09:02Z","modified":"2026-11-11T12:30:04.004300065Z","aliases":["GHSA-9j97-6pqr-qvrx"],"summary":"Malicious code in 0sec-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"0sec-cli","ecosystem":"npm","purl":"pkg:npm/0sec-cli"},"versions":["0.28.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/0sec-cli/MAL-2026-19118.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9j97-6pqr-qvrx"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-9j97-6pqr-qvrx","import_time":"2026-11-11T12:23:59.195275939Z","modified_time":"2026-11-11T12:09:02Z","sha256":"6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2","source":"ghsa-malware","versions":["0.28.10"]}]}}
{"schema_version":"1.9.2","id":"MAL-2026-19118","published":"2026-11-11T12:09:02Z","modified":"2026-11-11T15:30:05.177728839Z","aliases":["GHSA-9j97-6pqr-qvrx"],"summary":"Malicious code in 0sec-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"0sec-cli","ecosystem":"npm","purl":"pkg:npm/0sec-cli"},"versions":["0.28.10","0.28.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/0sec-cli/MAL-2026-19118.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9j97-6pqr-qvrx"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-9j97-6pqr-qvrx","import_time":"2026-11-11T12:23:59.195275939Z","modified_time":"2026-11-11T12:09:02Z","sha256":"6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2","source":"ghsa-malware","versions":["0.28.10"]},{"id":"GHSA-9j97-6pqr-qvrx","import_time":"2026-11-11T15:16:49.600626562Z","modified_time":"2026-11-11T14:53:13Z","sha256":"3c30d9423f714d9676d95618695bba34bd3a5f438a675f388502a9697790ec0b","source":"ghsa-malware","versions":["0.28.9","0.28.10"]}]}}
data/npm/MAL-2026-19119.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19119","published":"2026-11-11T14:35:24Z","modified":"2026-11-11T15:30:05.167073728Z","aliases":["GHSA-5xh5-qp4j-xjfx"],"summary":"Malicious code in cal-time-stamper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (72abd3a6cebf27a3e1f35df7ec7d603d5df43879a6b528927d6fb331fa3d8906)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"cal-time-stamper","ecosystem":"npm","purl":"pkg:npm/cal-time-stamper"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cal-time-stamper/MAL-2026-19119.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5xh5-qp4j-xjfx"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-5xh5-qp4j-xjfx","import_time":"2026-11-11T15:16:49.592209215Z","modified_time":"2026-11-11T14:35:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"72abd3a6cebf27a3e1f35df7ec7d603d5df43879a6b528927d6fb331fa3d8906","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19120.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19120","published":"2026-11-11T14:35:24Z","modified":"2026-11-11T15:30:05.162451116Z","aliases":["GHSA-fvf5-h3m3-g793"],"summary":"Malicious code in correct-calc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (5acdc2d413c5631f3fd8c1ce4442e9aaa50f794cd0359ac1cb8be9bbd55a5900)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"correct-calc","ecosystem":"npm","purl":"pkg:npm/correct-calc"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/correct-calc/MAL-2026-19120.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fvf5-h3m3-g793"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-fvf5-h3m3-g793","import_time":"2026-11-11T15:16:49.604798748Z","modified_time":"2026-11-11T14:35:25Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"5acdc2d413c5631f3fd8c1ce4442e9aaa50f794cd0359ac1cb8be9bbd55a5900","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19121.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19121","published":"2026-11-11T15:35:43Z","modified":"2026-11-11T16:31:41.533735799Z","aliases":["GHSA-jgmp-2vff-26jw"],"summary":"Malicious code in @tomhundley/condux (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (918d68d8e3d49a96a57f16c1777c683f90a0db5d0d3981de1a75104640f987fb)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@tomhundley/condux","ecosystem":"npm","purl":"pkg:npm/%40tomhundley/condux"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tomhundley/condux/MAL-2026-19121.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jgmp-2vff-26jw"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-jgmp-2vff-26jw","import_time":"2026-11-11T16:18:54.769776055Z","modified_time":"2026-11-11T15:35:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"918d68d8e3d49a96a57f16c1777c683f90a0db5d0d3981de1a75104640f987fb","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19122.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19122","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:30:44.598485644Z","aliases":["GHSA-65fw-m4q2-8ffh"],"summary":"Malicious code in @tomhundley/grafene (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (5013b2a9104c46960df3cf911ba95230dc32cec7c011ac529ba524140263da85)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@tomhundley/grafene","ecosystem":"npm","purl":"pkg:npm/%40tomhundley/grafene"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tomhundley/grafene/MAL-2026-19122.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-65fw-m4q2-8ffh"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-65fw-m4q2-8ffh","import_time":"2026-11-11T16:18:54.755360722Z","modified_time":"2026-11-11T15:35:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"5013b2a9104c46960df3cf911ba95230dc32cec7c011ac529ba524140263da85","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19123.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19123","published":"2026-11-11T15:35:43Z","modified":"2026-11-11T16:30:46.352814730Z","aliases":["GHSA-gfh2-8j8w-933m"],"summary":"Malicious code in @tomhundley/mypackagetest (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b54b162f0472b53354df190589cad77147e313297b09e74a1280f6d8e9f4eaf5)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@tomhundley/mypackagetest","ecosystem":"npm","purl":"pkg:npm/%40tomhundley/mypackagetest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tomhundley/mypackagetest/MAL-2026-19123.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gfh2-8j8w-933m"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-gfh2-8j8w-933m","import_time":"2026-11-11T16:18:54.766887915Z","modified_time":"2026-11-11T15:35:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b54b162f0472b53354df190589cad77147e313297b09e74a1280f6d8e9f4eaf5","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19124.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19124","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:30:46.352914121Z","aliases":["GHSA-qrxr-h27x-m353"],"summary":"Malicious code in @tomhundley/prismdb (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (e1a64a795f64a9eb3b4c77fb6a4dc6ce3b10f089f6e67588a6c3b90fe0f22d4e)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@tomhundley/prismdb","ecosystem":"npm","purl":"pkg:npm/%40tomhundley/prismdb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tomhundley/prismdb/MAL-2026-19124.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qrxr-h27x-m353"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-qrxr-h27x-m353","import_time":"2026-11-11T16:18:54.780969325Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"e1a64a795f64a9eb3b4c77fb6a4dc6ce3b10f089f6e67588a6c3b90fe0f22d4e","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19125.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19125","published":"2026-11-11T15:35:43Z","modified":"2026-11-11T16:30:44.448263689Z","aliases":["GHSA-gpvw-6mq7-2h5w"],"summary":"Malicious code in @tomhundley/sparkdash (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b2f704f9e809f18566ad6778d26de8eeab8342a3e3bf4f7d1fd9ceb13ef1e976)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@tomhundley/sparkdash","ecosystem":"npm","purl":"pkg:npm/%40tomhundley/sparkdash"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tomhundley/sparkdash/MAL-2026-19125.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gpvw-6mq7-2h5w"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-gpvw-6mq7-2h5w","import_time":"2026-11-11T16:18:54.767548057Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b2f704f9e809f18566ad6778d26de8eeab8342a3e3bf4f7d1fd9ceb13ef1e976","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19126.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19126","published":"2026-11-11T16:05:18Z","modified":"2026-11-11T16:30:44.596825885Z","aliases":["GHSA-24hp-9mx5-pqw7"],"summary":"Malicious code in aurelia-type (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (106679389edb6c05dcc60304b59b38fceec0641007040ef9a2bc500343a70d37)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"aurelia-type","ecosystem":"npm","purl":"pkg:npm/aurelia-type"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aurelia-type/MAL-2026-19126.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-24hp-9mx5-pqw7"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-24hp-9mx5-pqw7","import_time":"2026-11-11T16:18:54.719401757Z","modified_time":"2026-11-11T16:05:19Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"106679389edb6c05dcc60304b59b38fceec0641007040ef9a2bc500343a70d37","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19127.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19127","published":"2026-11-11T16:07:39Z","modified":"2026-11-11T16:30:44.601895194Z","aliases":["GHSA-qf7m-g96r-q7gq"],"summary":"Malicious code in chai-as-spy (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (64787b67d3c768f20c6657a4c4e0c11ede154d898d62e4b1bafc4028f3fbe4c8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"chai-as-spy","ecosystem":"npm","purl":"pkg:npm/chai-as-spy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chai-as-spy/MAL-2026-19127.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qf7m-g96r-q7gq"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-qf7m-g96r-q7gq","import_time":"2026-11-11T16:18:54.778918313Z","modified_time":"2026-11-11T16:07:47Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"64787b67d3c768f20c6657a4c4e0c11ede154d898d62e4b1bafc4028f3fbe4c8","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19128.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19128","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:43.241943233Z","aliases":["GHSA-8mrh-r693-wrfq"],"summary":"Malicious code in cronbits (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b3197e96ef6ef9b4f31f6011f346c4732315fec513da72240d8ec4c4af469b0c)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"cronbits","ecosystem":"npm","purl":"pkg:npm/cronbits"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cronbits/MAL-2026-19128.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8mrh-r693-wrfq"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-8mrh-r693-wrfq","import_time":"2026-11-11T16:18:54.762312342Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b3197e96ef6ef9b4f31f6011f346c4732315fec513da72240d8ec4c4af469b0c","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19129.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19129","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:43.637266819Z","aliases":["GHSA-78j2-8cm9-6g34"],"summary":"Malicious code in csvbits (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (c2fcb242f6ee5ce5ee0d16ae2a7bb5374d17eb9f9e983883e92e6922145493bd)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"csvbits","ecosystem":"npm","purl":"pkg:npm/csvbits"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csvbits/MAL-2026-19129.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-78j2-8cm9-6g34"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-78j2-8cm9-6g34","import_time":"2026-11-11T16:18:54.760576265Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"c2fcb242f6ee5ce5ee0d16ae2a7bb5374d17eb9f9e983883e92e6922145493bd","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19130.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19130","published":"2026-11-11T16:03:42Z","modified":"2026-11-11T16:31:43.992854668Z","aliases":["GHSA-w7c4-444m-w3r7"],"summary":"Malicious code in express-helmet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (01bc081b6433428f25c1ff2487ec9261e9a9bc0de174be268431d7c3339e60eb)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"express-helmet","ecosystem":"npm","purl":"pkg:npm/express-helmet"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-helmet/MAL-2026-19130.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w7c4-444m-w3r7"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-w7c4-444m-w3r7","import_time":"2026-11-11T16:18:54.7855679Z","modified_time":"2026-11-11T16:03:42Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"01bc081b6433428f25c1ff2487ec9261e9a9bc0de174be268431d7c3339e60eb","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19131.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19131","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:43.743285204Z","aliases":["GHSA-q97r-6qp3-r59x"],"summary":"Malicious code in flowbits (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (c1c2953a6c580e0482ccc6d86f9ec4cec505800bdf3e2556a7d8584d604e1cde)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"flowbits","ecosystem":"npm","purl":"pkg:npm/flowbits"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/flowbits/MAL-2026-19131.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q97r-6qp3-r59x"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-q97r-6qp3-r59x","import_time":"2026-11-11T16:18:54.777127596Z","modified_time":"2026-11-11T15:35:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"c1c2953a6c580e0482ccc6d86f9ec4cec505800bdf3e2556a7d8584d604e1cde","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19132.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19132","published":"2026-11-11T16:07:39Z","modified":"2026-11-11T16:32:17.847809761Z","aliases":["GHSA-x5mj-4fp8-3fg8"],"summary":"Malicious code in gloglet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (27917e66263c4e6087c4b2cbbdc4fb8e8d6b13da3b40209da2a2ab99f4fa096f)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"gloglet","ecosystem":"npm","purl":"pkg:npm/gloglet"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gloglet/MAL-2026-19132.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-x5mj-4fp8-3fg8"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-x5mj-4fp8-3fg8","import_time":"2026-11-11T16:18:54.787265216Z","modified_time":"2026-11-11T16:07:47Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"27917e66263c4e6087c4b2cbbdc4fb8e8d6b13da3b40209da2a2ab99f4fa096f","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19133.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19133","published":"2026-11-11T16:03:42Z","modified":"2026-11-11T16:31:43.238038166Z","aliases":["GHSA-6hfj-gc9f-mprr"],"summary":"Malicious code in helmify (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (bbe77795db05a220f8f66f7fa5d0d7570323b9e86839bf073254cf49de206c31)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"helmify","ecosystem":"npm","purl":"pkg:npm/helmify"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/helmify/MAL-2026-19133.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6hfj-gc9f-mprr"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-6hfj-gc9f-mprr","import_time":"2026-11-11T16:18:54.756930624Z","modified_time":"2026-11-11T16:03:43Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"bbe77795db05a220f8f66f7fa5d0d7570323b9e86839bf073254cf49de206c31","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19134.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19134","published":"2026-11-11T15:43:40Z","modified":"2026-11-11T16:31:43.988854341Z","aliases":["GHSA-66fx-r7cm-jxv6"],"summary":"Malicious code in ioredis-om-typed (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (4ae4f7bdb64662971c5c06f815a43ea6e39c4a5858278af4e938e0739054f385)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"ioredis-om-typed","ecosystem":"npm","purl":"pkg:npm/ioredis-om-typed"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ioredis-om-typed/MAL-2026-19134.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-66fx-r7cm-jxv6"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-66fx-r7cm-jxv6","import_time":"2026-11-11T16:18:54.756161065Z","modified_time":"2026-11-11T15:43:41Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"4ae4f7bdb64662971c5c06f815a43ea6e39c4a5858278af4e938e0739054f385","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19135.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19135","published":"2026-11-11T15:50:31Z","modified":"2026-11-11T16:31:43.738073898Z","aliases":["GHSA-5r2x-xv5p-58vg"],"summary":"Malicious code in ioredis-xyz (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (cae0a51364aaaf86a79b43a41760c31b2141b7e4c412b8b290ec41a888f3f0db)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"ioredis-xyz","ecosystem":"npm","purl":"pkg:npm/ioredis-xyz"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ioredis-xyz/MAL-2026-19135.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5r2x-xv5p-58vg"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-5r2x-xv5p-58vg","import_time":"2026-11-11T16:18:54.753972338Z","modified_time":"2026-11-11T15:50:32Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"cae0a51364aaaf86a79b43a41760c31b2141b7e4c412b8b290ec41a888f3f0db","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19136.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19136","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:43.644603222Z","aliases":["GHSA-qv92-rmvf-gfmp"],"summary":"Malicious code in jsonrail (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (6cbf40768a5bf5e46a71d80aff2bb57827f0eef07ada07542c358c347b5936c6)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"jsonrail","ecosystem":"npm","purl":"pkg:npm/jsonrail"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jsonrail/MAL-2026-19136.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qv92-rmvf-gfmp"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-qv92-rmvf-gfmp","import_time":"2026-11-11T16:18:54.78228921Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"6cbf40768a5bf5e46a71d80aff2bb57827f0eef07ada07542c358c347b5936c6","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19137.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19137","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:01.961743936Z","aliases":["GHSA-q9jm-97m9-6pw6"],"summary":"Malicious code in pathbits (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (a0829ff8923d3c848ba67ae064741353290ff7cc3f984a189b0fe0385eb998d8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"pathbits","ecosystem":"npm","purl":"pkg:npm/pathbits"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pathbits/MAL-2026-19137.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q9jm-97m9-6pw6"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-q9jm-97m9-6pw6","import_time":"2026-11-11T16:18:54.77804647Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a0829ff8923d3c848ba67ae064741353290ff7cc3f984a189b0fe0385eb998d8","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19138.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19138","published":"2026-11-11T16:03:42Z","modified":"2026-11-11T16:31:27.109706813Z","aliases":["GHSA-qpr9-cqf6-8m73"],"summary":"Malicious code in shraps (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (a490ee21191da673502cf8d36ab2a9011a3ed8c35fb5b5e7b563286643d6a9a1)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"shraps","ecosystem":"npm","purl":"pkg:npm/shraps"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shraps/MAL-2026-19138.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qpr9-cqf6-8m73"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-qpr9-cqf6-8m73","import_time":"2026-11-11T16:18:54.780188471Z","modified_time":"2026-11-11T16:03:42Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a490ee21191da673502cf8d36ab2a9011a3ed8c35fb5b5e7b563286643d6a9a1","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19139.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19139","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:45.964502337Z","aliases":["GHSA-73wm-q362-6xp2"],"summary":"Malicious code in taskpace (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (226b1ba3278805224b89b5ffee4e5cfa5de00214b8954baa87e7c89bba1e8176)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"taskpace","ecosystem":"npm","purl":"pkg:npm/taskpace"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/taskpace/MAL-2026-19139.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-73wm-q362-6xp2"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-73wm-q362-6xp2","import_time":"2026-11-11T16:18:54.759788793Z","modified_time":"2026-11-11T15:35:49Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"226b1ba3278805224b89b5ffee4e5cfa5de00214b8954baa87e7c89bba1e8176","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19140.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19140","published":"2026-11-11T15:35:44Z","modified":"2026-11-11T16:31:02.153596510Z","aliases":["GHSA-9mgw-vxc3-g2x8"],"summary":"Malicious code in textmark-engine (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (57d447410e77ecbc8e565ce77c7204640f06bfc937cce80b99cfa43d185adcb8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"textmark-engine","ecosystem":"npm","purl":"pkg:npm/textmark-engine"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/textmark-engine/MAL-2026-19140.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9mgw-vxc3-g2x8"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-9mgw-vxc3-g2x8","import_time":"2026-11-11T16:18:54.764325789Z","modified_time":"2026-11-11T15:35:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"57d447410e77ecbc8e565ce77c7204640f06bfc937cce80b99cfa43d185adcb8","source":"ghsa-malware"}]}}
data/npm/MAL-2026-19141.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"MAL-2026-19141","published":"2026-11-11T16:07:39Z","modified":"2026-11-11T16:31:46.065845769Z","aliases":["GHSA-m9gg-gx4w-v468"],"summary":"Malicious code in verboset (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (3a4093160dce8a65fe5ce463e8e166bbd21daf3f04a5d722a9133efb78a5d257)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"verboset","ecosystem":"npm","purl":"pkg:npm/verboset"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/verboset/MAL-2026-19141.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-m9gg-gx4w-v468"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-m9gg-gx4w-v468","import_time":"2026-11-11T16:18:54.770623298Z","modified_time":"2026-11-11T16:07:40Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3a4093160dce8a65fe5ce463e8e166bbd21daf3f04a5d722a9133efb78a5d257","source":"ghsa-malware"}]}}
state/sync.json
+8 -8
View File
@@ -25,10 +25,10 @@
"records": 2010
},
"OSS-Fuzz": {
"etag": "\"121d45b88a3a072c5385693bbdaef2e4\"",
"last_modified": "Tue, 10 Nov 2026 17:48:45 GMT",
"last_success": "2026-11-10T20:34:59.745211+00:00",
"records": 4290
"etag": "\"6becd549ff0c3e8881d6c196a7310eaa\"",
"last_modified": "Wed, 11 Nov 2026 17:33:11 GMT",
"last_success": "2026-11-11T18:46:24.391220+00:00",
"records": 4291
},
"Packagist": {
"etag": "\"33cd85e43eaaa872adb7d5a2a05ea651\"",
@@ -55,10 +55,10 @@
"records": 3093
},
"npm": {
"etag": "\"ae5e057b4685c9a089e5afd2e3a83f19\"",
"last_modified": "Wed, 11 Nov 2026 12:32:53 GMT",
"last_success": "2026-11-11T12:50:33.290104+00:00",
"records": 231666
"etag": "\"6b79d1e35f8137dd20011bab0947794e\"",
"last_modified": "Wed, 11 Nov 2026 17:48:14 GMT",
"last_success": "2026-11-11T18:46:17.881918+00:00",
"records": 231690
}
},
"version": 1