Khang Vo (doublevkay)

We are seeking sponsors to support 03 Vietnamese students to join International Cybersecurity Challenge (IC3) held in San Diego, US. Join us in making a meaningful impact. Your generosity is greatly appreciated!❤️ko-fi.com/vnsec/goal?g=18

Today we're proud to announce the release of version 1.0 of SLSA 🎉 Supply-chain Levels for Software Artifacts is an OpenSSF project that provides specifications for software supply chain security, established by community expert consensus. #OSSecurity

Verichains has released a new security advisory VSA-2022-120, exposing a key extraction vulnerability in Multichain's fastMPC. Kudos to @MultichainOrg for the swift response and bug bounty. Keep an eye out for upcoming advisories on critical attacks targeting popular MPC implementations. blog.verichains.io/p/vsa-2022-120…

@fraxken @MyUnisoft Can't wait for your sharing!

I'm writing a new technical article around a challenge we faced with the Node.js team at @MyUnisoft 👀. I thought I'd get it out soon enough but it's turning out to be quite a challenge to write 😂. I really need to write more... I keep a lot of technical stuff to myself 😫.

@liran_tal Code pilot :D

Did you upgrade to GitHub Pro? What features are you enjoying the most with that?

(CVE-2022-2564): Prototype Pollution in automattic/mongoose. huntr.dev/bounties/055be… Disclosed by @doublevkay, fixed by @code_barbarian... #opensource #CVE #bugbounty #security #vulnerability

@JamieSlome @huntrdev thanks, Jamie. You help me a lot!

@doublevkay @huntrdev Great work @doublevkay ♥️

I have submitted 18 reports, 9 validated, and 4 CVEs in a month. Just small things for the beginning, but yeah, glad that I end up at the #top2 leaderboard (30 days) on @huntrdev. Appreciate the #CodeQL help! Wish you all happy hacking!😁

@s0nnguy3n_ @momentjs @npmjs @huntrdev Dạ em cảm ơn anh 😁

@doublevkay @momentjs @npmjs @huntrdev wow, good job em, có thêm nhiều bug mới nữa nhé 😄

I have found a high severity vulnerability in @momentjs - one of the most depended-upon packages on @npmjs. The vulnerability has been found with CodeQL, reported on @huntrdev. It is also my first #CVE, first #bugbounty, and the first GHSA credit.😄 huntr.dev/bounties/f0952…

@Sudouhack @momentjs @npmjs @huntrdev I think `npm audit` could be a good entry. In the black-box case, a particular approach would be more realistic though.

@doublevkay @momentjs @npmjs @huntrdev Do you know of any documentation on how to test outdated libraries like this, when found in an application?

It is a good experience with @huntr - an awesome platform for contributing security issues to the open-source community. 👍

@byt3bl33d3r Quick look at @snyksec db, there are over 450 malicious packages on @npmjs.

Holy supply chain attacks batman