Fallout in container, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

WEDNESDAY

Wed Aug 19 · 1 catch · 0 waves · 1 single

36d

docker.io/library/logstash 8.19.20 container 202,148,107 installs 36 days ago

HTTP desync probe in dependency

depends on hostile gem: http_parser.rb v0.6.0-javastring/array

MONDAY

Mon Aug 17 · 1 catch · 0 waves · 1 single

38d

docker.io/library/varnish 9.0.1 container 21,859,521 installs 38 days ago

Hostile dependency embedded in sample

create/directanalysis-bomb/rule-timeout

O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories