MAL-2026-52 Malicious code in celium-collateral-upgrade (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 adea9a91926d593420b0d9d07dd66bc5656bb42bf3735074a3f33533800a79dc This is a typosquatting/dependency confusion package that is part of a campaign embedding malicious code but was found before the malicious code was injected...

MAL-2026-53 Malicious code in gztensor-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6010189e23e54782200df770b6e40ed7e37284779c25f28cd145aadd9ee8b623 Package clones a legitimate library and adds a hidden code that downloads a malicious script. The script then downloads an archive with malicious executable in...

Malicious code in gztensor-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6010189e23e54782200df770b6e40ed7e37284779c25f28cd145aadd9ee8b623 Package clones a legitimate library and adds a hidden code that downloads a malicious script. The script then downloads an archive with malicious executable in...

New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code

Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer also styled as VVS $tealer that's capable of harvesting Discord credentials and tokens. The stealer is said to have been on sale on Telegram as far back as April 2025, according to a repo...

curl: PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic Flaw

Summary A structural logic flaw in the libcurl Alt-Svc header parser allows attack attributes specifically persist and max-age to "leak" from one service definition to another. We have successfully chained this logic bug with curl's HTTP/3 QUIC support to demonstrate a Persistent UDP Amplificatio...

MAL-2025-192995 Malicious code in @vietmoney/react-native-action-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df1a9f2c1ef7c8dd8ece133048315f8ab738a4d5d8bf1a11dbe5f932d39e2eca The package @vietmoney/react-native-action-button was found to contain malicious code. Source: ghsa-malware...

Exploit for CVE-2025-52691

CVE-2025-52691 PoC: SmarterMail Arbitrary File Upload RCE APT...

Malicious code in @ptest2535/artifactory-demo-ptest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d121743e4ae61b32780c6a0ea72f57b23796b21513e57f998da725dd49318 The package @ptest2535/artifactory-demo-ptest was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192980 Malicious code in @ptest2535/l_woker_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4196b81679a34023da03dc65cd5831c81e6c9d66d1a3617113d28a85b23c83c The package @ptest2535/lwokermal was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ptest2535/ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7628a65ea5a9b366c3df0045c4c0a1c8b44ec278dc10792f971ed266fe08ce5a The package @ptest2535/ui-coremal was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192974 Malicious code in rt-interactive-card-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9858817ec5f5e5af9db5f5033c3626e4214faa07e1169e950573bbca309a975e The package rt-interactive-card-collection was found to contain malicious code. Source: ghsa-malware...

curl: Cross‑Layer State Confusion in libcurl: Credential & Key‑Material Persistence Across Redirect / Connection Reuse Boundaries

Summary: This report describes a state‑level security invariant violation in libcurl where credential‑ or key‑related state may persist or be re‑applied across logical trust boundaries redirects, connection reuse, or scheme transitions without a formal invariant enforcing reset semantics. The iss...

Malicious code in chai-max (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bf9b30832b678dc77fdae0e722638e2a3ff7ba5cf07b09960233418192dd073 The package chai-max was found to contain malicious code. Source: ghsa-malware a6e46cc56f071a0c9f8afeaa19cf981997f743503c55a5e155fd1c99bf53d3a4 Any...

Malicious code in huangmingming-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34b1eeb67a3d88661777e42783fdb91d2347376e8c6eae10588f559642d2bf53 The package huangmingming-demo was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192729 Malicious code in streamixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6f5d50225f8dd17a6c0a9e647d0a80d71926d7f823045d07d45861a2c1c3c41 The package streamixer was found to contain malicious code. Source: ghsa-malware 42a8a19c11260eb91e74995275ea815a4b32ec414471d02bee390b603ae81cdf Any...

MAL-2026-169 Malicious code in secguest-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae83c0c9ae4ffab006e7b6d1833b54dfb5386dedf3e94dedf500b3af1dc82d1c The package secguest-lib was found to contain malicious code. Source: ghsa-malware 62ef36b4b0912fdc42b94702acf5c8e48b06cb2d3370113c3c875479aacd5e9f A...

Malicious code in secguest-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae83c0c9ae4ffab006e7b6d1833b54dfb5386dedf3e94dedf500b3af1dc82d1c The package secguest-lib was found to contain malicious code. Source: ghsa-malware 62ef36b4b0912fdc42b94702acf5c8e48b06cb2d3370113c3c875479aacd5e9f A...

📄 Assistive Technologies Persistence

This Metasploit module achieves persistence by registering a custom Assistive Technology AT in the Windows registry. Then it configures the system to launch the AT executable during user logon or desktop switch such as with an admin privileged program. Requires Windows 8 or higher and...

📄 IGEL OS Workspace Edition 11.10.430 Privilege Escalation

IGEL OS Workspace Edition version 11.10.430 suffers from a privilege escalation vulnerability. This vulnerability demonstrates how architectural trust in custom configuration frameworks can be abused to establish long-term persistence, even on systems designed to be non-persistent and hardened by...

MAL-2026-46 Malicious code in github-badge-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f427bc7bcd3bfb173311bffdab461e2c6fc5350dc9ab3f7dc5e9a4ef6d16728 The package github-badge-bot was found to contain malicious code. Source: ghsa-malware f87cd6af8d38dd37db1b6aca4f637451fe3303fa73ed0705216e3711bc4d01...