iOS18.6.2-Persistent-Automation-Exploit-in-Siri-Shortcuts-and-Apple-SWC

Validación de Entrada Inadecuada en Siri Shortcuts y Shared Web Credentials Descubierto por: Joseph Goydish II Fecha de descubrimiento: 20 de agosto de 2025 Gravedad: Alta Resumen Ejecutivo Este informe describe una cadena de vulnerabilidades de alta gravedad que afecta a Siri Shortcuts y al...

Nim-Reverse-Shell

Shell inversa en Nim Una shell inversa simple escrita en Nim que evita la detección de Windows Defender consulta la sección "Sistemas operativos probados" a continuación para más detalles. Este código está hecho solo con fines educativos. Sistemas operativos probados Windows 10 10.0.19045 Windows...

MAL-2026-13600 Malicious code in dolyame-ui-tableinline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8 On require'dolyame-ui-tableinline', index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors...

Malicious code in dolyame-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91017d9e387f2441738f4ffe07ce8807a3af9385f2c506cf165fa851d011f53 On require'dolyame-ui-action', index.js loads support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose...

MAL-2026-13161 Malicious code in dolyame-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4668c9441e4f15054a71b066764259aac91f52c51e48ff2656a63c9a09f96e5d On require of dolyame-ui-island, index.js loads setup.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-shopping-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a04004bb44c701e1976ef3d6678efb4cd9668d5a4986937c62928d1345550a86 On require of this package, index.js loads polyfill.js which selects a platform-specific download URL, reconstructs hostnames via array.join...

MAL-2026-12624 Malicious code in claims-historical-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997 index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments e.g...

MAL-2026-12648 Malicious code in claims-use-visual-viewport-resizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb On require, index.js loads helpers.js which auto-invokes start. The code selects a platform-specific asset, fetches an opaque binary over HTTPS from...

Malicious code in constructor-blocks-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a...

MAL-2026-12446 Malicious code in statist-browser-typed-client-itsa.digitalinterview.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f27a3b0f4b5c8f210576fe33a1251d774926e6c7405591948c5bc3dfa00e7aa On require, index.js loads init.js which selects an OS/arch-specific staging path, downloads a binary payload from hardcoded Cloudflare Workers hosts...

Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12454 Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12255 Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

MAL-2026-10094 Malicious code in @equansservices/setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b071598889a04c74a8398157555ccfffda5bbc713429df4cafbcf48df7f811af package.json declares a postinstall hook node setup.js that fires automatically on npm install. setup.js selects a platform-specific target and fetch...

ASB-A-376048041

In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-45566

Name of the Vulnerable Software and Affected Versions Android Framework affected versions not specified Description Multiple functions within PipTaskOrganizer.java contain a confused deputy issue that allows an activity to be launched from the background. This flaw enables a local escalation of...

CVE-2026-43578

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged contex...

EUVD-2026-28168

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged contex...

Embedded Malicious Code

Overview @velora-dex/sdk is a SDK for the Velora API Affected versions of this package are vulnerable to Embedded Malicious Code that delivers a malicious payload through dist/index.js. An attacker uploaded a compromised version of the package directly to the npm registry. The payload runs a...