Malicious code in kuaishou (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd1d5daf09cc7bfff164e60bf5abd0a1b374b5bb616f0a78cac8f6c6ea613608 The package's prepare lifecycle script, which runs automatically on npm install, collects host, user, and platform identifiers along with the full...

Malicious code in rtc-integration-frontend-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acfd49527fb8be1135feb424b68f6c46779ba146d8372d276eac1735770d6e5a [email protected] registers a postinstall lifecycle hook "postinstall": "node index.js" that fires automatically on npm install...

MAL-2026-10129 Malicious code in rtc-integration-frontend-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acfd49527fb8be1135feb424b68f6c46779ba146d8372d276eac1735770d6e5a [email protected] registers a postinstall lifecycle hook "postinstall": "node index.js" that fires automatically on npm install...

MAL-2026-10110 Malicious code in nodemon-patch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15ac606888cb1a54710bafa78dc76d760bef1088bb5e2cc0f0323614341345e5 The package is named nodemon-patch but its package.json metadata homepage https://nodemon.io, author Remy Sharp / github.com/remy, repository, fundin...

MAL-2026-10092 Malicious code in vite-pwa-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab1e251883a8eceecc27c935ed05352375d438c1efbbd8727f2b13a766409d0 Package vite-pwa-config impersonates the popular vite-plugin-pwa antfu — the README instructs users to import configJson from vite-plugin-pwa, and...

Malicious code in webrix-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname,...

Malicious code in chai-as-buffered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a [email protected] is a typosquat lure name resembles chai-as-promised; README and module exports impersonate the pino logger whose actual...

MAL-2026-10041 Malicious code in chai-as-buffered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a [email protected] is a typosquat lure name resembles chai-as-promised; README and module exports impersonate the pino logger whose actual...

Malicious code in chai-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...

Malicious code in @wagni_bot/web3-toolkit (npm)

The npm package @wagnibot/web3-toolkit is a supply-chain credential stealer disguised as a web3.js SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/eth-agent (npm)

The npm package @wagnibot/eth-agent is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/jupiter-sdk (npm)

The npm package @wagnibot/jupiter-sdk is a supply-chain credential stealer disguised as a Jupiter Solana DEX aggregator SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

MAL-2026-6994 Malicious code in chai-presentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d078bac337fe2c1b76c757c29d286fc750be585db65f30f5d696038c2ea0d3a On require, index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's cookie field to new Function'require',...,...

Malicious Package

Overview github.com/kaleidora/dnsub-scanning-tool is a malicious package. This package contains malicious code and while hile this package might be attempting to impersonate a legitimate DNS/subdomain scanning tool, there is no connection between that valid project and this package, which conceal...

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by...

MAL-2026-10115 Malicious code in fmt-date-lite (npm)

The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...

ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories

This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This is not one big break. It is small permissions, weak check...

Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its...

Malicious code in clob-client-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36bbf14a743630a93ba7f8d7529d3fae8073f0f585af4343506be6248fc1b59 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

Malicious code in ryan-pdf-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3d966501b5f533318c26b54887cd29b3cd6c9495035a0f74519ba349357e3eb [email protected] is an empty stub package index.js exports whose sole purpose is to deliver an off-registry payload at install time. Its package.js...