Malicious code in paymentlookup-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a353126553c901a947450d8496b7b7479aa1c0b81c8cbbe5784801c4304be21b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in invoiceread-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4462bd23e04580838c5d69582dd0687b88a333d82d6b64a876c17bbcdf7f5ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2444 Malicious code in invoiceread-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4462bd23e04580838c5d69582dd0687b88a333d82d6b64a876c17bbcdf7f5ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

A week in security (March 3 – March 9)

Last week on Malwarebytes Labs: TikTok: Major investigation launched into platform’s use of children’s data PayPal scam abuses Docusign API to spread phishy emails Android zero-day vulnerabilities actively abused. Update as soon as you can I spoke to a task scammer. Here’s how it went Android...

MAL-2025-2221 Malicious code in userbridge-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0146b1598c87e386ded31eb79929185a8d623f2541a8ef352804662a2ec1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in userbridge-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0146b1598c87e386ded31eb79929185a8d623f2541a8ef352804662a2ec1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2222 Malicious code in userrelationship-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 522db266cc5ee9a741f9a3fde1a0f9e69cd84419296d3011e1e89833d068d06c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in userrelationship-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 522db266cc5ee9a741f9a3fde1a0f9e69cd84419296d3011e1e89833d068d06c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PayPal scam abuses Docusign API to spread phishy emails

PayPal scammers are using an old Docusign trick to enhance the trustworthiness of their phishing emails. We've received several reports of this recently, so we dug into how the scam works. The Docusign Application Programming Interface API allows “customers” to send emails that come from genuine...

Malicious code in adminauthserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f01fbeb3da8a3ec0a1c93f3ff5431e6be6693f2a2e13482834637f2b73e99d13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2058 Malicious code in buttonfactoryserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 158238f70853c391431a3c0e3b53d79d44970a0d956562c88324b2c1da5e08e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buttonfactoryserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 158238f70853c391431a3c0e3b53d79d44970a0d956562c88324b2c1da5e08e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paypal-expanded-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1913 Malicious code in paypal-expanded-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=-...

A week in security (February 24 – March 2)

Last week on Malwarebytes Labs: Millions of stalkerware users exposed again PayPal’s "no-code checkout" abused by scammers Countries and companies are fighting at the expense of our data privacy Roblox called "real-life nightmare for children" as Roblox and Discord sued Android happy to check you...

Malicious code in paypal-sdk-server-side-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7cbb479a86e79945f77f69a5ee3fa04d2ed76af23ea3bc9de04b02ed5cc0b4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2047 Malicious code in paypal-sdk-server-side-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7cbb479a86e79945f77f69a5ee3fa04d2ed76af23ea3bc9de04b02ed5cc0b4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paypal-checkout-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8978fb3635d1339256e1aa90eab3f76ba33bad36f9a2ffd70d1f6fc7d60ccca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1619 Malicious code in paypal-checkout-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8978fb3635d1339256e1aa90eab3f76ba33bad36f9a2ffd70d1f6fc7d60ccca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ideal-paypal-payment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0c63436afa43460fe75374c026568d5b5f17a29326ac24517be8a2b1dcd113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...