MAL-2026-12690 Malicious code in deposits-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d03bd134745bb66c8ba26a5ee1ddd2f9417eab449bd8ca7a4c649064cf38f1 index.js requires./support on module load. support.js reconstructs obfuscated hostnames via string split-and-join oob-worker.cf101-adf.workers.dev,...

SkillSpector v2.5.3

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

IOSSecuritySuite v2.3.0

⭐️ Do you want to become a certified iOS Application Security Engineer? ⭐️ Check out our practical & fully online course at: https://courses.securing.pl/courses/iase ISS Description by @r3ggi 🌏 iOS Security Suite is an advanced and easy-to-use platform security & anti-tampering library written in...

Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

Malicious code in streak-daykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...

MAL-2026-12466 Malicious code in streak-daykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...

Antiphishing v30963641348

DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI Protect against phishing attacks Functionality This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs and NRD Newly Registered Domain to construct these...

screenpipe app-v2.5.176

DOWNLOAD SCREENPIPE screenpipe | YC S26 Screenpipe remembers how you actually work Record your screen continuously locally and provide context to your agents Claude, Codex, Openclaw, Hermes, Runner... https://github.com/user-attachments/assets/70fe94eb-6d2a-47ca-b7c3-c8ead13a5b7f news 06/10 - we...

Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

MAL-2026-12211 Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

Kali365 Exploits Microsoft Device Login to Access US Corporate Data

Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks...

garak v0.16.0

garak, LLM vulnerability scanner Generative AI Red-teaming & Assessment Kit garak checks if an LLM can be made to fail in a way we don't want. garak probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and many other weaknesses. If you know nm...

phpstan v2.2.8

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

copyfail-guard Ferramenta de detecção e mitigação automatiz...

SkillSpector v2.5.2

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

MAL-2026-12047 Malicious code in streak-day-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch,...

[SECURITY] Fedora 44 Update: abrt-2.17.9-1.fc44

abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...

Checked-In Secret Detection: Strings Are All You Need

Hardcoded secrets in source code pose critical security vulnerabilities which can be easily exploited by malicious adversaries. Existing regex-based detection approaches suffer from fundamental limitations, as secrets often lack identifiable patterns, resulting in poor precision and recall. Recen...