{"uuid": "459f1d81-6988-493c-9bef-069cc348fc55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-18074", "type": "seen", "source": "https://t.me/hacking_Attack/66512", "content": "kage: 1744 days old\u201d,\n\u201cinvalid or no homepage: insecure webpage\u201d,\n\u201cgenerates new code at runtime\u201d,\n\u201cfetches data over the network\u201d,\n\u201creads files and dirs\u201d,\n],\n\u201cvulnerable\u201d: [\n\u201ccontains CVE-2018-18074,CVE-2018-18074\u201d\n]\n}\n=> Complete report: /tmp/pypi-requests-2.18.4.json\n=> View pre-vetted package report at https://packj.dev/package/PyPi/requests/2.18.4 Non-containerizedAlternatively, you can install Python/Ruby dependencies locally and test it.\n\nNOTE\n\n* Packj has only been tested on Linux.\n* Requires Python3 and Ruby. API analysis will fail if used with Python2.\n* You will have to install Python and Ruby dependencies before using the tool:\n* pip install -r requirements.txt* gem install google-protobuf:3.21.2 rubocop:1.31.1$ python3 main.py npm eslint\n[+] Fetching \u2018eslint\u2019 from npm\u2026OK [ver 8.16.0]\n[+] Checking version\u2026OK [10 days old]\n[+] Checking release history\u2026OK [305 version(s)]\n[+] Checking release time gap\u2026OK [15 days since last release]\n[+] Checking author\u2026OK [nicholas+npm@nczconsulting.com]\n[+] Checking email/domain validity\u2026OK [nicholas+npm@nczconsulting.com]\n[+] Checking readme\u2026OK [18234 bytes]\n[+] Checking homepage\u2026OK [https://eslint.org]\n[+] Checking downloads\u2026OK [23.8M weekly]\n[+] Checking repo_url URL\u2026OK [https://github.com/eslint/eslint]\n[+] Checking repo data\u2026OK [stars: 20669, forks: 3689]\n[+] Checking repo activity\u2026OK [commits: 8447, contributors: 1013, tags: 302]\n[+] Checking for CVEs\u2026OK [none found]\n[+] Checking dependencies\u2026ALERT [35 found]\n[+] Downloading package \u2018eslint\u2019 (ver 8.16.0) from npm\u2026OK [490.14 KB]\n[+] Analyzing code\u2026ALERT [needs 2 perms: codegen,file]\n[+] Checking files/funcs\u2026OK [395 files (390 .js), 1022 funcs, LoC: 76.3K]\n[+] 2 risk(s) found, package is undesirable!\n{\n\u201cundesirable\u201d: [\n\u201cgenerates new code at runtime\u201d,\n\u201creads files and dirs: [\u2018package/lib/cli-engine/load-rules.js:37\u2019, \u2018package/lib/cli-engine/file-enumerator.js:142\u2019]\u201d\n]\n}\n=> Complete report: /tmp/npm-eslint-8.16.0.json How It Works* It first downloads the metadata from the registry using their APIs and analyze it for \u201crisky\u201d attributes.\n* To perform API analysis, the package is downloaded from the registry using their APIs into a temp dir. Then, packj performs static code analysis to detect API usage. API analysis is based on\u00a0MalOSS, a research project from our group at Georgia Tech.\n* Vulnerabilities (CVEs) are checked by pulling info from OSV database at\u00a0OSV\n* Python PyPI and NPM package downloads are fetched from\u00a0pypistats\u00a0and\u00a0npmjs\n* All risks detected are aggregated and reported Risky AttributesThe design of Packj is guided by our study of 651 malware samples of documented open-source software supply chain attacks. Specifically, we have empirically identified a number of risky code and metadata attributes that make a package vulnerable to supply chain attacks.\n\nFor instance, we flag inactive or unmaintained packages that no longer receive security fixes. Inspired by Android app runtime permissions, Packj uses a permission-based security model to offer control and code transparency to developers. Packages that invoke sensitive operating system functionality such as file accesses and remote network communication are flagged as risky as this functionality could leak sensitive data.\n\nSome of the attributes we vet for, include\nAttributeTypeDescriptionReasonRelease dateMetadataVersion release date to flag old or abandonded packagesOld or unmaintained packages do not receive security fixesOS or lang APIsCodeUse of sensitive APIs, such as execand evalMalware uses APIs from the operating system or language runtime to perform sensitive operations (e.g., read SSH keys)Contributors\u2019 emailMetadataEmail addresses of the contributorsIncorrect or invalid of email addresses suggest lack of 2FASource repoMetadataPresence and validity of public source repoAbsence of a public repo means no easy way to audit or review the source code publicly \nFull list of the attributes [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:25.658875Z"}