Tag
Detection of Typosquatted Python Package Installation
2 rules 2 TTPsA detection identifies suspicious installations of Python packages, leveraging Cisco NVM flow telemetry to monitor `pip` or `poetry` commands making outbound connections to public repositories for package names resembling known typosquats, indicating potential malicious software supply chain compromise.
Incomplete Package Integrity Verification in Chainguard apko and melange Allows Data Section Substitution
2 TTPsA critical vulnerability, CVE-2026-54174, in Chainguard's apko and melange packages allows attackers to substitute arbitrary file contents within packages due to incomplete integrity verification, potentially leading to remote code execution.
dpkg: Vulnerability Enables Information Disclosure
1 TTPA remote, unauthenticated attacker can exploit a vulnerability in the dpkg package management system to disclose information from the affected system, potentially exposing sensitive data or system details to unauthorized parties.
OCaml opam Path Traversal Vulnerability (CVE-2026-41082)
2 rules 1 TTP 1 CVEOCaml opam before 2.5.1 is vulnerable to path traversal via a crafted .install file, potentially allowing attackers to overwrite arbitrary files.
Elastic Defend Alert from Package Manager Install Ancestry
3 rules 1 TTPThis rule detects Elastic Defend alerts where the alerted process has a package-manager install context in its ancestry (npm, PyPI, Rust), indicating potential supply chain compromise via malicious postinstall scripts.