CredsLeaker

CredsLeaker v4.x 特别感谢 @ApSecDev，他将这个项目提升到了一个新的水平！ 致敬！ 这个脚本曾经用来显示一个PowerShell凭据框并要求用户输入凭据。然而，这非常显眼。现在是时候利用Windows安全弹窗了！ 功能特性 AD域身份验证。 已在Windows 10（1809、1903、1909）和PowerShell 5.1上测试。需要在7/8/8.1/Server及不同PowerShell版本上测试。 可自定义（标题、消息等）。 增加了工作组支持（针对本地SAM进行验证）。 增加了参数支持。现在可以通过命令行自定义消息、标题、IP和端口。 此分支新增功能...

TurkoRat

TELEGRAM 版本 ⚔️ TurkoRat 🛡️ Telegram 服务器：https://t.me/turcoflex Discord 服务器：https://discord.gg/xTsJReFG84 加入新 Discord 🌐 〢 目录 📁 设置 ⚔️ 功能 📸 截图 📝 待办事项 📜 许可证 ⚠️ 注意 📁 〢 设置 安装 Node.js 重要提示：安装 Node.js 时，同时安装“Tools for Native Modules” = 勾选 Automatically install the necessary tools. Note that this will also...

RunAs-Stealer

RunAs-Stealer RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging Usage The stealers are running in a while loop the injector also in Hooking case in the background, to kill them use Task Manager. The stolen credentials...

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

Malicious code in secret-key-totp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6 [email protected] declares a postinstall hook node./index.js --setup that executes a credential stealer and dropper on install, and the same...

MAL-2026-14255 Malicious code in secp256k1-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main index.js is a singl...

Malicious code in ethereum-vault-connector (npm)

ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...

Malicious code in @umacloud/cli-linux-x64 (npm)

npm/@umacloud/cli-linux-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in umadev (npm)

npm/umadev is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the worm...

Malicious code in @adminide-stack/clock-tik-browser (npm)

npm/@adminide-stack/clock-tik-browser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

MAL-2026-11954 Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11788 Malicious code in @qlik/dts-bundler (npm)

npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11958 Malicious code in @umacloud/cli-linux-x64 (npm)

npm/@umacloud/cli-linux-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11953 Malicious code in @umacloud/cli-darwin-arm64 (npm)

npm/@umacloud/cli-darwin-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11551 Malicious code in @adminide-stack/clock-tik-browser (npm)

npm/@adminide-stack/clock-tik-browser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

MAL-2026-11960 Malicious code in @umacloud/knowledge (npm)

npm/@umacloud/knowledge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in @qlik/nebula-table-utils (npm)

npm/@qlik/nebula-table-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11575 Malicious code in @nebula.js/sn-line-chart (npm)

npm/@nebula.js/sn-line-chart is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11807 Malicious code in @qlik/sprout-icons (npm)

npm/@qlik/sprout-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11805 Malicious code in @qlik/sprout-design-docs (npm)

npm/@qlik/sprout-design-docs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...