Nouvelle vulnérabilité zero-day critique dans la bibliothèque populaire Log4j | Lire l'article

Informations Nexus Intelligence

Essayer maintenant  

Deep dive into Sonatype Security Research

See incredible research performed (24x7x365) by our team.  Learn how open source exploits work.  Get expert guidance on how to remediate risk.

Image of a man holding a chainsaw with smoke around him

New Log4j 1.x CVEs, and critical Chainsaw Vulnerability — What to Do?

This week Apache disclosed 3 vulnerabilities impacting Log4j 1.x versions.

Lire la suite

npm Libraries ‘colors’ and ‘faker’ Sabotaged in Protest by their Maintainer—What to do Now?

In what can only be described as one of the most bizarre events in the history of open source, we find that the massively popular open source libraries, colors.js, and faker.js were sabotaged by

Lire la suite
Image of the word hijacking in scrabble like letters with coding scripts behind it

Researcher Takes Over qr.js via Repo Hijacking. Is the npm Package Safe?

We can’t end this year without talking about open source package hijacks one more time.

Lire la suite
Image of a column building with the word bank on it

Les failles Log4j sont maintenant utilisées pour diffuser le cheval de Troie bancaire Dridex

As the log4j vulnerability disclosures come out, and ongoing exploitation in the wild is on, we have been closely monitoring developments and tracking the gap between the disclosures and how fast

Lire la suite

Log4shell en chiffres - Pourquoi CVE-2021-44228 a-t-il mis le feu à Internet ?

On Friday, the news broke about Log4Shell, an easy-to-exploit vulnerability being exploited across the world. We have kept our blog from Friday up to date with the latest news, mitigations and

Lire la suite
Laptop with code showing open source vulnerability exploit

Critical New 0-day Vulnerability in Popular Log4j Library Discovered  with Evidence of Mass Scanning for Affected Applications - Latest updates

News broke early Friday morning of a serious 0-day Remote Code Execution exploit in log4j - CVE-2021-44228- the most popular java logging framework used by Java software far and wide. This type of

Lire la suite
Malware

Tracking the ‘Noblox.js’ npm Malware Campaign

A new malicious package, noblox.js-rpc was spotted on the npm registry this month that leverages the same techniques we saw before to steal all sorts of sensitive data like credentials, files, and

Lire la suite

NPM Hijackers at it Again: Popular ‘coa’ and ‘rc’ Open Source Libraries Taken Over to Spread Malware

Just last week we saw the popular npm package `ua-parser-js` get hijacked. Malicious actors gained access to the project maintainer’s npm account and published malicious versions that attempted to

Lire la suite
Scary-movie style scene of hand on television screen.

Un faux paquet npm Roblox API installe un ransomware et a une surprise effrayante

The world was just coming to terms with the “ua-parser-js” npm library hijacking incident, and Sonatype’s discovery of crypto-mining malware from last week, when we found a bigger, and spookier,

Lire la suite
Disabling an explosive

Popular npm Project Used by Millions Hijacked in Supply-Chain Attack

Last week, Sonatype reported our discovery of three malicious npm cryptomining packages on npm: klow, klown, and okhsa. These packages, which infiltrated the npm registry between October 12th and

Lire la suite
Image of bitcoin breaking through a dollar bill

Newly Found npm Malware Mines Cryptocurrency on Windows, Linux, macOS Devices

Update: Following our disclosure of these malicious packages, the legitimate library "ua-parser-js" used by millions was itself was found to be compromised. We have released a subsequent blog post

Lire la suite
Image of a line of cones with one knocked over

From Feature to Vulnerability: a spring-security-oauth2-client Story

Spring Security provides security services for the Spring IO Platform, available on their Github repository. Today we focus on the “oauth2” client, which provides an application with the

Lire la suite