AgentSmith-HIDS

AgentSmith-HIDS --The name of this project was inspired by the movie - The Matrix English | 简体中文 THIS REPO IS OLD RELEASE VERSION: https://github.com/bytedance/Elkeid About AgentSmith-HIDS Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System HIDS due to lack of rule engine...

Malicious code in trijigo-kalip (PyPI)

Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

MAL-2026-18114 Malicious code in trijigo-kalip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in workalender (PyPI)

Source: kam193 bb4f2824499fd64a22d9dfdb23c454bbb8797422f5281fdd5f454ea64095853a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in asurion (PyPI)

Source: kam193 05820dd77e1f73d1a01797af6f10c6fa4ae22038be3fcd6a8cbd8c117cf6436c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in asurion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 393ccbeed4c71a6a21a3a697f0809845dddec09ddc8884662f40e2b2257a28a9 setup.py executes at pip install time and POSTs a JSON payload containing the full os.environ dictionary along with hostname, username, current worki...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Enrich Zeek logs with host information To enrich all logs with an id field, use the tag ".-all". To enrich all logs with an id field, and the Known Entities, use the tag ".-known-all". To only enrich the conn.log, use the tag ".-conn". To only enrich the conn.log, and the...

MAL-2026-17763 Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

MAL-2026-17628 Malicious code in erc7730-hackathon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in erc7730-hackathon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17487 Malicious code in css-snap-target-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42 The package ships thunderboltRegistry.js, which uses childprocess and process.platform to collect host information and POSTs it via fetch to the...

Malicious code in css-snap-target-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42 The package ships thunderboltRegistry.js, which uses childprocess and process.platform to collect host information and POSTs it via fetch to the...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

Malicious code in echogen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

MAL-2026-17194 Malicious code in metrics-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60ce93696722d633e9eea7b3fac6f76ebe61a581bd2d1d79efb778f8cb015399 metricssdk 999.0.0 is a dependency-confusion beacon. setup.py runs on pip install and metricssdk/init.py runs on import metricssdk; both hex-encode t...

MAL-2026-15934 Malicious code in dbt-sa-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...

Malicious code in metricboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...

MAL-2026-15931 Malicious code in metricboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...