sample-ldap-exploit

sample-ldap-exploit A short demo of CVE-2021-44228 Build $ mvn clean verify Run Attacker $ java \ -cp 'attacker/target/sample-attacker.jar:attacker/target/lib/' \ sample.attacker.Attacker localhost 1389 sample.payload.Payload 8080 payload/target/sample-payload.jar URLs: http://localhost:8080/...

Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...

MAL-2026-18095 Malicious code in resion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b4088658d04bc0725d06a035fa9d83254699e6c26ce3653433199de9b10821 No a static rule matches were produced for this package version, and no concrete behavioral evidence of credential access, install-time code executio...

Malicious code in resion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b4088658d04bc0725d06a035fa9d83254699e6c26ce3653433199de9b10821 No a static rule matches were produced for this package version, and no concrete behavioral evidence of credential access, install-time code executio...

Malicious code in bitcoin-address-utils (RubyGems)

Source: amazon-inspector 8af579a1726db72e88f7c1755ebdec49a2d0a944d0e42a0fb36566d70d751e17 The gem's native-extension build script extconf.rb, which runs automatically during gem install, decodes a base64-wrapped Ruby payload that XOR-decodes a hardcoded URL approximately...

Malicious code in css-gwqyid-polyfill (npm)

Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/ip addr output and sends each result as a GET query-string ...

Malicious code in lightning-invoice-utils (RubyGems)

RubyGems runs this gem's native extension script ext/lightning-invoice-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is ov...

Malicious code in swnwall (npm)

Source: amazon-inspector 70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a On require/import, index.js invokes initialize which spawns loader.js as a detached, hidden background child process detached: true, windowsHide: true, stdio: 'ignore', unref'd and records a.pid file to avoi...

Malicious code in greensaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec [email protected] declares a postinstall script "node lib/greensaver.js" that runs automatically on npm install. The script decodes two files...

Malicious code in web3-eth-account (PyPI)

Source: kam193 bd36aeb2d45881a66bf5373c0b91a108637938dab5e0c153525e6f938c9c9503 A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The...

Malicious code in eth-account-web3 (PyPI)

Source: kam193 25b1d3ecadcdc171186f8b8c574e830d3078a33be08f0455fd7bafc179d028ca A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The...

MAL-2026-16127 Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

Malicious code in elephant-array-utils (npm)

Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no functionality matching the advertised 'array utils' purpose. O...

MAL-2026-16101 Malicious code in mfaby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278e0ee3820cf701ef7ad65dfdab43a0765e5d3423286de99d3301fe39a8455 The package presents itself as a Discord MFA helper, but its cache module contains a warmSession routine that decodes a base64-encoded string CDNBASE...

CVE-2026-57159

A flaw was found in PJSIP. An out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. A remote attacker can trigger this via payload-type numbers taken from a remote SDP offer or answer, which are used as an index to access...

Malicious code in devplatform-jscodeshift-plugin (npm)

Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worke','r.cf101-a','df.workers.d','ev'.join'' and a DNS-TXT fallback channel via...

Malicious code in devplatform-prettier-config (npm)

Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in devplatform-rest-resources-v2 (npm)

Source: amazon-inspector 51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316 On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at...

Malicious code in devplatform-api-v1-endpoint (npm)

Source: amazon-inspector f2ed0defa1fbae571985664baae47d89d796f943b249115eb73a38edce04fb6c On require, adapter.js selects a platform-specific asset path and fetches an executable from string-split-obfuscated hosts under oob-worker.cf10-.workers.dev, falling back to base64-encoded payload chunks...

EUVD-2026-71653

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...