Public repository contains Remote Code Execution vulnerability

Question

Hello,

The following public repository contains malicious code:
https://bitbucket.org/ethvault-tech-team/ethvault/src/master/

In file server/controllers/productController.js, the function `getCookie` downloads arbitrary code from:
https://api.mocki.io/v2/964ug6uu
and executes it locally using `new Function(...)` with `require`.

This is a Remote Code Execution vulnerability that could fully compromise a user’s machine.
The repository has been online since July 10, 2025 and is being shared with job candidates as a “technical test”.

Please investigate and take action to remove or restrict this repository.

Frantz Galinier-Stefani · Answer

Thank you Ben and the Atlassian team for your quick action and professionalism. I really appreciate the seriousness with which this issue was handled, ensuring the safety of developers and candidates. It’s reassuring to see such responsiveness from the community and support team.

Ben · Answer

I can confirm that the content has been taken down, and the user has been de-activated

Ben · Answer

Hi @Frantz Galinier-Stefani

Thank you for raising this to our attention. I've just reported this directly to our anti-abuse team and will let you know the outcome.

Cheers!

- Ben (Bitbucket Cloud Support)