Fallout in golang, Aug 24 – Aug 30

What we caught this week while monitoring over 163,363,865 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

TUESDAY

Tue Aug 25 · 4 catches · 0 waves · 3 singles

30d

github.com/projectdiscovery/retryablehttp-go v1.0.38 golang 30 days ago

Hostile dependency embedded in archive

30d

github.com/aerospike/aerospike-client-go/v6 v6.16.1 golang 30 days ago

Embedded malicious dependency

30d

github.com/terraform-prov…aform-provider-aws v1.60.0 golang 30 days ago

HTTP desync probe in dependency

MONDAY

Mon Aug 24 · 3 catches · 0 waves · 3 singles

30d

github.com/cosmtrek/air v1.52.1 golang 30 days ago

Hostile dependency: credential exfiltration

30d

github.com/dprotaso/go-yi…0260623150633-6f1ed93922d1 golang 30 days ago

HTTP desync probe in dependency

30d

github.com/azkaban/azkaba…0170502223633-32e9ba51fded golang 30 days ago

Hostile dependency NuGet.exe embedded

depends on hostile npm: eonasdan-bootstrap-datetimepicker v4.17.47rat/multi

O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories