Public repository contains Remote Code Execution vulnerability

[Frantz Galinier-Stefani]

Hello,

The following public repository contains malicious code:
https://bitbucket.org/ethvault-tech-team/ethvault/src/master/

In file server/controllers/productController.js, the function `getCookie` downloads arbitrary code from:
https://api.mocki.io/v2/964ug6uu
and executes it locally using `new Function(...)` with `require`.

This is a Remote Code Execution vulnerability that could fully compromise a user’s machine.
The repository has been online since July 10, 2025 and is being shared with job candidates as a “technical test”.

Please investigate and take action to remove or restrict this repository.

[Mikael Sandberg]

Hi @Frantz Galinier-Stefani,

Welcome to Atlassian Community!

Please report this to abuse@atlassian.com and they will take action on it. Just note that the team will not reply back. 

[Frantz Galinier-Stefani]

Ok, thx 

[Ben]

Hi @Frantz Galinier-Stefani 

Thank you for raising this to our attention. I've just reported this directly to our anti-abuse team and will let you know the outcome.

Cheers!

- Ben (Bitbucket Cloud Support)

[Ben]

I can confirm that the content has been taken down, and the user has been de-activated

[Frantz Galinier-Stefani]

Thank you Ben and the Atlassian team for your quick action and professionalism. I really appreciate the seriousness with which this issue was handled, ensuring the safety of developers and candidates. It’s reassuring to see such responsiveness from the community and support team.