Malicious code in metoopro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6e089d4b8b0fe90a96024c1160f198df5ab7ec0b30f1f5765cf81ef4aa640279 Designed to run on Android. Under the mask of an AI agent, the code downloads a remote executable on import, and during usage, silently exfiltrates data like...

Malicious code in coloreasyprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d52af876a91a6ff5ff8144b705201fd465db94ad89f0e1b37bd22fe6ca0f5622 During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage...

MAL-2026-3127 Malicious code in coloreasyprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d52af876a91a6ff5ff8144b705201fd465db94ad89f0e1b37bd22fe6ca0f5622 During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage...

Malicious code in pathjoin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a94ee2403006fa62b8cfd3e6ac5a3ae32f316ab9b32fd0dc47fefdca52cf5899 During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage...

MAL-2026-2949 Malicious code in pathjoin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a94ee2403006fa62b8cfd3e6ac5a3ae32f316ab9b32fd0dc47fefdca52cf5899 During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage...

Malicious code in supervisors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9f99997c1443b3be7bee7a7d490d05077e1d1c48bdd801f7357881ab1a73ca0 The setup.py contains a malicious code that skips execution if the system uses Russian language. Otherwise, it downloads the URL of the next stage payload from...

MAL-2026-2448 Malicious code in supervisors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9f99997c1443b3be7bee7a7d490d05077e1d1c48bdd801f7357881ab1a73ca0 The setup.py contains a malicious code that skips execution if the system uses Russian language. Otherwise, it downloads the URL of the next stage payload from...

Malicious code in modelconftranslator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6f61fcbf30122cbf577490fab3968c6b41f95d4d23f6916a7211066bd735ff6e During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments - in older packages - attempts to...

Malicious Package

Overview transform-jscript is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...

Malicious Package

Overview transform-dynamic-import is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior...

CVE-2026-1698

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints...

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

A PyPI user account compromised by an attacker and was able toupload a malicious version 1.1.5.post1 of the dydx-v4-client package.This version contains a highly obfuscated multi-stage loaderthat ultimately executes malicious code on the host system.While the final payload is not visible because ...

TOTOLINK A3300R 安全漏洞

TOTOLINK A3300R is a wireless router from China Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A3300R that stems from improper access control and could allow an unlogged-in attacker to remotely send a payload...

Malicious Package

Overview tailwindcss-animation-style is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of th...

Tenda AC18 安全漏洞

Tenda AC18 is a dual-band wireless router launched by Shenzhen Jixiang Tenda Technology Co. in July 2016, mainly for villas and large home users. Tenda AC18 suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data by th...

CVE-2025-43829

CVE-2025-43829 is a stored XSS vulnerability in Liferay Commerce diagram logic. A crafted SVG file can inject script/HTML, affecting Liferay Portal 7.4.3.18–7.4.3.111 and Liferay DXP 2023.Q3.1–2023.Q4.5 (including 2023.Q3.8 and 7.4 update 18–92). The issue originates from the diagram web componen...

Malicious code in cti-ctf-challenges (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1cefe6c8a9ac6ede7c6ba497cf17011bf431812980749bb0068995ebba4039d9 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the...

MAL-2025-191928 Malicious code in web3dummycti (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9a702a53b1f08d4ee8e06e9dc19f6c942ee7bd755274f898a2ff737796557316 If the method from the module is called, it attempts to download a malicious code identified as msf payload and save it locally. In the analysed version, the...

iOS Activation Flaw Enables Pre-User Device Compromise

A critical vulnerability exists in Apple’s iOS activation pipeline that allows remote XML payload injection before the user ever interacts with the device...

CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...