NewsSANS NewsBites
GitHub Announces Default Changes Coming in npm v12
NEOSEC enrichment — no mirror of the original source
GitHub says it will change npm default settings to prevent the install command from running scripts automatically: preinstall, install, and postinstall from dependencies will not run unless explicitly allowed. The change is one of three npm
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Dukes, Neely.
More on GitHub
Other advisories
- Not ratedosv:CLEANSTART-2023-TQ13876Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1
- Not ratedosv:CLEANSTART-2024-SO37224Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3
- Not ratedosv:CLEANSTART-2024-RQ55668NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3
- Not ratedosv:CLEANSTART-2024-TN04539User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3
- Not ratedosv:CLEANSTART-2024-UR95058Use After Free in GitHub repository radareorg/radare2 prior to 5
- Not ratedosv:CLEANSTART-2024-YD39274Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2
- Not ratedosv:CLEANSTART-2024-RS42730Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5
- Not ratedosv:CLEANSTART-2024-CO02071Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5
Other news entries
- Hugging Face malware campaign returns to hijack GPUs for crypto miningNewsBleepingComputer
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto MinersNewsThe Hacker News
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hourNewsThe Register — Security
- Gut getarnt: Automatisch startender Wurm bei GitHub ist schwer zu findenNewsheise Security
- GitHub Launches npm Firewall to Block Malicious Packages Before InstallationNewsThe Hacker News
- GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHubNewsDark Reading
- Gheist turns GitHub Actions into a secret extraction serviceNewsCSO Online
- Attackers compromised 42 GitHub repositories by using files too large to be searchedNewsCSO Online
ID