Malicious code in solana-login (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

MAL-2025-45 Malicious code in solana-login (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

PT-2025-37481

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s btrfs subsystem within the btrfs copy root function. Specifically, if an unexpected extent buffer generation is encountered during cloning, the...

Burp Extension Persistence

This module adds a java based malicious extension to the Burp Suite configuration file. When burp is opened, the extension will be loaded and the payload will be executed. Tested against Burp Suite Community Edition v2024.9.4, on Ubuntu Desktop 24.04. Tested against Burp Suite Community Edition...

Obsidian Plugin Persistence

This module searches for Obsidian vaults for a user, and uploads a malicious community plugin to the vault. The vaults must be opened with community plugins enabled NOT restricted mode, but the plugin will be enabled automatically. Tested against Obsidian 1.7.7 on Kali, Ubuntu 22.04, and Windows...

Malicious code in do-not-install-this-plz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adc3e11ee2ba7ba338bcea114510c201b2b2f788a4d1bb7d938a3c823353772c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in centers-of-excellence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db7470e26934fe6244d0a4418e105a9007fb9f8357f17951f481193ce6a0888f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in js-dos-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d534d9ec05d6809f40b3db232c0e24e612234ca30b7d46155b7aa6043c7d02a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in requesr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b792f17b467610a1021820a7718884aa436487a9ec75d5ebf889d400efeaec24 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category:...

MAL-2024-12338 Malicious code in requesr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b792f17b467610a1021820a7718884aa436487a9ec75d5ebf889d400efeaec24 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category:...

PT-2024-17791 · Evoko · Evoko Home

Name of the Vulnerable Software and Affected Versions: Evoko Home versions 2.4.2 through 2.7.4 Description: The issue is related to incorrect default permissions in Evoko Home, allowing a non-admin user to exploit weak file and folder permissions and potentially escalate privileges, execute...

Malicious code in layerzero-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e38548e48278e6b84fe1732117aef2c443aee26ea8e5694692002fe7342e1e30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BellaCPP: Discovering a new BellaCiao variant written in C++

Introduction BellaCiao is a .NET-based malware family that adds a unique twist to an intrusion, combining the stealthy persistence of a webshell with the power to establish covert tunnels. It surfaced for the first time in late April 2023 and has since been publicly attributed to the APT actor...

Malicious code in serum-dex-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23e693f28915ad1c0bf05e8f5e0e1cab49a329f00b7f27303d08ec76d8ab068f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rdjjfjooirpp.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0def3cb04d3fb8c638daf6a97a708bd6b95632da63635563110d5827170cfff5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v420 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 291a2b6b3559f93316c3fa8d0ab9ddf6a6417051190512d339da5b8c5e5827cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hyperion-react-testapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99a7ef31fe91a90b5e4780028e2f80cfe27e522aa931ce419fa5bed74d0c17fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spinal-env-viewer-plugin-documentation-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3d2a0a560ea9b62097643b0b538b82a0eba36ef923886755262eeecca376650 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gft-sam-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e518541b06a8fad0288da6a0e31b730a6044da6a63fdfe2d8a471d90aac7655 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in manajemenservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00f781e5ec61ec2d725507626667d8de0819e01e64f92bcd3d1b5232b99df76d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...