Malicious code in bnpl-blocks-mobile-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a2921266e52f201547a9cd08fabd37f291c1db3c02e22c6b546206dfb9c20d On require of this package, index.js loads adapter.js which invokes bootstrap at module load. The code selects a platform-specific endpoint, assemble...

MAL-2026-13023 Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...

Malicious code in dc-dc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e706ce5be3f3c1cf779ad16844cea8737714c708fe739316bec4ff400b415139 On require'dc-dc-core', index.js loads support.js which fetches a platform-specific native binary from obfuscated Cloudflare worker hosts...

MAL-2026-12690 Malicious code in deposits-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d03bd134745bb66c8ba26a5ee1ddd2f9417eab449bd8ca7a4c649064cf38f1 index.js requires./support on module load. support.js reconstructs obfuscated hostnames via string split-and-join oob-worker.cf101-adf.workers.dev,...

Malicious code in pfp-block-independent-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

MAL-2026-12235 Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

Malicious code in chai-as-uphelded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7f5470790594e55393048fee0e7a9e6e6650776a06717258e410292d4dc8a9 Package name impersonates the popular chai-as-promised library, but its package.json description and keywords masquerade as a pino-style logger and a...

Malicious code in chai-as-forgeted (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b32b714919c755532ed3d2695d1966568c24878e9721a5d756896d81881020 Package name impersonates the popular chai-as-promised assertion library, but its package.json description and keywords are copied from pino and the...

HTTPS Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an HTTPS server. Custom shellcode stage. Listen for a connection Module Options msf use payload/cmd/windows/https/x86/custom/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...sho...

HTTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an HTTP server. Custom shellcode stage. Connect back to the attacker Module Options msf use payload/cmd/windows/http/x86/custom/reversetcprc4 msf payloadreversetcprc4 show actions ...actions... msf payloadreversetcprc4 set ACTION msf payloadreversetcprc4 show...

HTTP Fetch, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)

Fetch and execute an x86 payload from an HTTP server. Custom shellcode stage. Listen for an IPv6 connection Windows x86 Module Options msf use payload/cmd/windows/http/x86/custom/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp...

Anatomy of an Attack

In today's rapidly evolving cyber threat landscape, organizations face increasingly sophisticated attacks targeting their applications. Understanding these threats and the technologies designed to combat them is crucial. This article delves into the mechanics of a common application attack, using...

TFTP Fetch, Windows x64 IPv6 Bind TCP Stager

Fetch and execute an x64 payload from a TFTP server. Listen for an IPv6 connection Windows x64 Module Options msf use payload/cmd/windows/tftp/x64/meterpreter/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show options ...sho...

New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices

A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different...

Symantec Altiris DS SQL Injection

This module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8 to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize numeric input fields in "UpdateComputer" notification Requests. In order to spawn a shell, several SQL injections are...

Dokeos <= 1.8.0 (my_progress.php course) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Dokeos = 1.8.0 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com &n...