php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detecta archivos PHP potencialmente maliciosos. ¿Qué detecta? PHP-malware-finder hace todo lo posible para detectar código ofuscado/sospechoso, así com...

CASHEWS: Source Preprocessor for LLM-Based Malicious Package Detection

Malicious npm package detection tools now leverage LLMs' semantic understanding of source code to detect malicious intent at scale. This capability has proven invaluable in identifying packages involved in recent supply-chain attacks such as Shai-Hulud. However, threat actors exploit the limited...

Malicious code in cclr-component-resources (npm)

Multiple evidences suggest this package is a malware: code obfuscation, dynamic code execution, suspicious domain, and unusual install script. Source: amazon-inspector 61af3265fce06cfbb9bbf20e38d468e136487f69c41f70b0bbb1b331535bdf82 The package cclr-component-resources was found to contain...

Malicious code in @crysnovax/baileys (npm)

@crysnovax/baileys is a renamed fork of the Baileys WhatsApp Web library. On every successful connection connection.update with connection === 'open', wired in lib/Socket/socket.js it silently makes the user's own authenticated WhatsApp account follow two channels controlled by the publisher,...

MAL-2026-15917 Malicious code in @crysnovax/baileys (npm)

@crysnovax/baileys is a renamed fork of the Baileys WhatsApp Web library. On every successful connection connection.update with connection === 'open', wired in lib/Socket/socket.js it silently makes the user's own authenticated WhatsApp account follow two channels controlled by the publisher,...

Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...

Malicious code in luluking1 (npm)

Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at...

MAL-2026-14250 Malicious code in luluking1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply,...

MAL-2026-14205 Malicious code in @sarex-team/translator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6 The package's install lifecycle script scripts.install="node index.js" automatically executes on npm install and loads lib/core.js. That module reads...

Malicious code in @sarex-team/translator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6 The package's install lifecycle script scripts.install="node index.js" automatically executes on npm install and loads lib/core.js. That module reads...

Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Malicious code in pygremlinbox-malware-code-obfuscation (PyPI)

--- Credit: OpenSSF source...

Malicious Package

Overview @gocortexio/npmgremlinbox-malware-code-obfuscation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

MAL-2026-10833 Malicious code in @gocortexio/npmgremlinbox-malware-code-obfuscation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ebdefd4ff4715215a3a457497ee797677c748f28b881a45b05fda760142b5e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @gocortexio/npmgremlinbox-malware-code-obfuscation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-10165 Malicious code in @injectivelabs/sdk-ts (npm)

@injectivelabs/[email protected] published 2026-07-08 20:59 UTC contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets durin...

Malicious code in paysafe-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ef2b75345902c9fe851d85e09c4b6680a3685669ab4dcd8b827ebaebb46626 Package metadata claims to be the 'Official Paysafe SDK for Python' by 'Paysafe Developer Team', but the shipped module is a stealer disguised as a...

Malicious code in paysafe-payments (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2b7f287703755dab866acf1047a148e321d06a84353238936eaba58b6e7fda Package impersonates the Paysafe payments SDK metadata claims 'Paysafe Developer Team', 'Paysafe Payments processing library' but its advertised...

MAL-2026-6928 Malicious code in paysafe-payments (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2b7f287703755dab866acf1047a148e321d06a84353238936eaba58b6e7fda Package impersonates the Paysafe payments SDK metadata claims 'Paysafe Developer Team', 'Paysafe Payments processing library' but its advertised...

Malicious code in paysafe-kyc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c619e500f8070a5525694f42547c0b73e8189965f8816f1a124190f50bed6f5 The paysafe-kyc package impersonates a legitimate Paysafe KYC/payments SDK author string 'Paysafe Developer Team', base URL https://api.paysafe.com,...