ExtensionHijack

ExtensionHijacker A possible malware persistence method. Hijacking extensions registered for the current user. Read more here proxyapp - a proxy application, used to handle hijacked extensions hijackerapp - installs the proxy application and redirects extension handling to the proxy...

react-cve-2025-55182

react-cve-2025-55182 This is a dump of malware and other suspicious junk I found on the server for my wedding website following the react server side rendering code execution exploit. Its a dinky digital ocean droplet running a fairly pedestrian next js app. The CVE:...

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

RatHat Android malware uses generative AI to navigate infected devices, steal banking credentials, intercept OTP codes and reinstall itself after removal again...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

MAL-2026-13673 Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f33793b44bee99cf40ae7b4ecfdd4d8ab388edf96753862f96b289ad3e95d2 Package contains only 2 files and no code patterns indicating credential access, network exfiltration, install-time code execution, silent relay, or...

MAL-2026-12017 Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...

MAL-2026-11487 Malicious code in tailwindcss-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01f26860cd01782ea3614f8dd2d144ced75af610edac79984c24d67dee41d8a index.js hides a base64-encoded payload after a long run of tab characters and executes it via evalatob... at module load, so any require/import of t...

MAL-2026-11491 Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

Malicious code in mongostose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers.jsonn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acfd52ff30b26f15be66cbf87a098dde096288d776d0be4ecd555ac81e229f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11293 Malicious code in eth.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83a74d7ffe1be2c23f1dc0a21529f6785e63c80990839f2d44aeaa4f514bef37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thoughtgear (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e2acc307a077bd79ae28a6f8b7a5448b7947bcaa7496bbbf29804d5a11e5f21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11235 Malicious code in ag-grid-boost (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48a0535bdc8dc48399716c0e05646161556ce93b7b3cfeb7ba095e9bc3e1df5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea99a3f3b1743882b257e9f10fe8ce5575c81f7ce1a439fb5a4da12ead9b1e5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4116fb9fa0f1722871be8fd4fdc1d54633acc0f32aea0c74372ed72b2a147d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in etwl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e526e1b1272a9b3c18948e466b5380d199c4a81ff4ecd198c2ec0dfa2d69bfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fwf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67afa7fe22e11e200dbb0a033b897eb7ff275ba6b5c33ec15e1371bf1b8feb08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11220 Malicious code in @patternfly-4/react-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5f54e5643951668f9122f9909e456f67938b47d7ecb0cddf1fde02666a66ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11218 Malicious code in @nordea-web/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 366bacc3988f49deff2b60fae8cddafa449cc7e3df8475fd364c974bbfd7e7ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11336 Malicious code in ncc-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0dc78eaeb84c645221a6f51ea2488913faab13484c8be0761ff46b7edb4c698 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...