Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

MAL-2026-17488 Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

MAL-2026-17485 Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...

MAL-2026-17481 Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...

Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

MAL-2026-17480 Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

MAL-2026-17476 Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

MAL-2026-17491 Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

DNSint

DNSint 🔍 Kit de reconnaissance DNS et OSINT professionnel Un outil complet d'intelligence DNS et d'analyse de sécurité pour la reconnaissance de domaines Créé par wh0xac Fonctionnalités • Installation • Utilisation • Exemples • Documentation 🎯 Aperçu DNSint est un outil puissant et tout-en-un de...

surface_recon

SurfaceRecon SurfaceRecon is an experimental reconnaissance...

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the...

INtrack

INtrack - 인터넷 크롤러 및 보안 스캐너 INtrack은 네트워크 정찰, 취약점 탐지, 보안 평가를 위해 설계된 강력한 멀티스레드 보안 스캐너이자 인터넷 크롤러입니다. 다양한 인스턴스, 취약점, IoT 기기, 노출 항목 등을 스캔할 수 있습니다. 기능 🔍 포괄적 스캔 : 웹 서버, 애플리케이션, 취약한 서비스 등을 탐지 🌐 유연한 대상 선택 : 단일 호스트, 서브넷, 무작위 인터넷 IP 또는 파일의 대상 스캔 🛠️ 다양한 스캐너 유형 : 알려진 CVE에 대한 취약점 스캐너 인스턴스 탐지 WordPress, Jira,...

Malicious code in com.epi.e2e_test (npm)

Source: amazon-inspector 5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b package.json declares a preinstall script that runs index.js on npm install. index.js collects host identifiers os.homedir, os.hostname, os.userInfo.username, dns.getServers, current working directory along...

MAL-2026-17415 Malicious code in com.epi.e2e_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b package.json declares a preinstall script that runs index.js on npm install. index.js collects host identifiers os.homedir, os.hostname,...

Malicious code in com.epi.e2e_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b package.json declares a preinstall script that runs index.js on npm install. index.js collects host identifiers os.homedir, os.hostname,...

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. Talos first observe...