Malicious code in @lekzo_dev/amprem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link'...

MAL-2026-17361 Malicious code in @kanaraa/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17360 Malicious code in @jojoxyz/condemnedforce-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17811 Malicious code in @ikanngeming/blubub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6701e3a14d508c7dfb1376d6becb7c1b53519b04c4b3bcdcd4c3706778150e61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17817 Malicious code in nakkinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 331be4e62118311084ef5b928ef3bedc450c59ffb7433d02246886cf501727dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17812 Malicious code in @ikanngeming/npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50b6c41210ca33afed30bcb7c8f5b78df510ea3a5f10608d48c6c45d240cbabb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17816 Malicious code in ikanngeming (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 966642a4fb31fee9c17517bf5b81d34a3d86345ee225b4dfc07f33bdd6636112 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-3094_xz_check

CVE-2024-3094 xz Check Script This repository contains a Bash script and a one-liner command to verify if a system is running a vulnerable version of the "xz" utility, as specified by CVE-2024-3094. See the description and impact statement below from information available via RedHat...

MAL-2026-17810 Malicious code in @zaka13/zakasite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15276369023f332e049b1b25b23be8b056ce333649434f79d0f41f3bbb1930b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-35674

Description CVE-2023-35674 is a high-severity zero-day security vulnerability in the Android Framework. This vulnerability allows an attacker to escalate their privileges without requiring user interaction or additional execution permissions. The vulnerability occurs in how the Android Framework...

threatDemos

🚨 Android Security Threat Demonstrations Repository A comprehensive collection of proof-of-concept Android security vulnerabilities and attack vectors This repository serves as an educational resource showcasing real-world Android security threats and their corresponding mitigation strategies. Ea...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

Malicious Package

Overview npp-ml is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview minecraftaccfinder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview py2ops is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-17446 Malicious code in luoxy-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17803 Malicious code in hridoy-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157 hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in...

Malicious code in crypto-tax-export (RubyGems)

Source: amazon-inspector d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea The gem's native-extension build script ext/cryptotaxexport/extconf.rb runs during gem install. Before executing its payload it performs sandbox/analysis-evasion checks CI environment variables,...

Malicious code in seed-phrase-validator (RubyGems)

Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a base64-encoded Ruby payload and runs it via eval inside a detached fo...

Malicious code in liferay-workspace-scripts (npm)

Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz instead of a registry version range. On npm install, npm...