-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[remediation] On a CONFIRMED compromise, condemn and rebuild node_modules instead of deep-scanning it
enhancementNew feature or requestNew feature or requestStatus: Open.#1379 In Ndevu12/stayAwakeBot;[detection] saw does not scan /var/tmp-class survivors or mounted filesystems (network shares, external drives) where payloads persist
detectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seeStatus: Open.#1378 In Ndevu12/stayAwakeBot;[detection] saw cannot see a compromised dependency tree staged in a Docker image or volume
detectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seeStatus: Open.#1377 In Ndevu12/stayAwakeBot;[detection] saw does not scan the global npm install prefix, where a payload survives both a home-wipe and a repo scan
detectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seeStatus: Open.#1376 In Ndevu12/stayAwakeBot;[detection] obfuscated-source-file trips on Tailwind class strings, atob() and a size array
bugSomething isn't workingSomething isn't workingdetectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seeStatus: Open.#1375 In Ndevu12/stayAwakeBot;[detection] evil-merge fires on ordinary sync merges — two clean cases in one repository
bugSomething isn't workingSomething isn't workingdetectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seeStatus: Open.#1374 In Ndevu12/stayAwakeBot;[discussion] Should saw take scoped GitHub credentials to enumerate account-level footholds (self-hosted runner registrations)? — deferred from #1340
detectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seeStatus: Open.#1373 In Ndevu12/stayAwakeBot;feat(remediation): There isn't anyway to fix evil-merge since the malware committ still in the history?
questionFurther information is requestedFurther information is requestedremediationRemediation behaviour and the guidance saw emitsRemediation behaviour and the guidance saw emitsStatus: Open.#1372 In Ndevu12/stayAwakeBot;[detection] Live egress-timing for a COMPILED dead-man daemon — the interval-regularity case #1335 leaves to monitoring
detectionDetection capability: what saw can and cannot seeDetection capability: what saw can and cannot seequestionFurther information is requestedFurther information is requestedStatus: Open.#1368 In Ndevu12/stayAwakeBot;saw fix --remote can exit 0 for repos it never fixed (auth-unreachable / clone-failed)
bugSomething isn't workingSomething isn't workingStatus: Open.#1349 In Ndevu12/stayAwakeBot;[hardening] Should saw recommend making high-value files immutable to survive a wipe — or is that advice a footgun?
hardeningPreventive posture and mitigation guidancePreventive posture and mitigation guidanceStatus: Open.#1346 In Ndevu12/stayAwakeBot;[research] Does the wipe follow symlinks out of the home directory? Unknown, and it changes what saw can say about backup safety
researchNeeds investigation or empirical verification before scopingNeeds investigation or empirical verification before scopingStatus: Open.#1345 In Ndevu12/stayAwakeBot;