CVE-2023-25439

Stored Cross Site Scripting XSS vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details...

Telegram Hosting World’s Largest Darknet Market

Wired is reporting on Chinese darknet markets on Telegram. The ecosystem of marketplaces for Chinese-speaking crypto scammers hosted on the messaging service Telegram have now grown to be bigger than ever before, according to a new analysis from the crypto tracing firm Elliptic. Despite a brief...

A week in security (December 15 – December 21)

Last week on Malwarebytes Labs: CISA warns ASUS Live Update backdoor is still exploitable, seven years on The ghosts of WhatsApp: How GhostPairing hijacks accounts Chrome extension slurps up AI chats after users installed it for privacy Two Chrome flaws could be triggered by simply browsing the...

Pig butchering is the next “humanitarian global crisis” (Lock and Code S06E25)

This week on the Lock and Code podcast … This is the story of the world's worst scam and how it is being used to fuel entire underground economies that have the power to rival nation-states across the globe. This is the story of "pig butchering." "Pig butchering" is a violent term that is used to...

Malicious code in nabuf-otimmn-pig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24b5bed1dd7a2eb120de0c8fa47c2a56cf41d113ee91d2caec8781176397730 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-143917

Malicious code in nabuf-otimmn-pig npm...

EUVD-2025-117008

Malicious code in varying-harlequin-pig npm...

MAL-2025-139094 Malicious code in varying-harlequin-pig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0efc01ffd237e30ebc8d6127cd738b563f653d3dafc2d41d0dbb803d7037bc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-95262

Malicious code in rivalpigz3n npm...

Malicious code in rival_pig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ce00fda0ea0db147296236274e588b4175e845035a85632f9c48c286f4b2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-92682

Malicious code in confidentialpigz3n npm...

EUVD-2025-74198

Malicious code in statutorypigivory-20 npm...

EUVD-2025-76249

Malicious code in monetarypig-toolteadev npm...

EUVD-2025-78753

Malicious code in mysteriouspigz3n npm...

EUVD-2025-77729

Malicious code in assistantpigz3n npm...

Malicious code in icy_pig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0481a1c5ce0d14f56a8b346e792b8dcfc8dac4a35157a11eea17aac2f58ccfd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in coloured_pig_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9432cda3948339cf86fe5b217b8326147337161bc111a33d9ccf58f08af69efe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in powerful_pig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eef69b82bf03822615136883d4c0a6bfd4d5a9da9c2d08c10e8370087baab7bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-73472

Malicious code in strongpigrequirement npm...

MAL-2025-96818 Malicious code in strong_pig_requirement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a56c44868c5c0fa99218f32d9f2b5c7d1fd71c5f5e422c92d35dea4a656a625 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...