LinusWare-Source-Code-Internal

Linusware 1.2 — Source Code & Engine Architecture Reconstructed, Reverse-Engineered & Documented by tekkenbugatti Target Platform: Linux x8664 / Luau / Roblox Runtime Engine Overview Linusware 1.2 is a native Linux x8664 runtime extension and execution engine for Roblox / Luau. This repository...

MAL-2026-16059 Malicious code in rojo-rbx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a...

Malicious code in minecraftmodes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2057275d7d6bc39e22d9147702d20b43fcabcab4e438821e823010937448eb6c The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

MAL-2026-15937 Malicious code in minecraftmodes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2057275d7d6bc39e22d9147702d20b43fcabcab4e438821e823010937448eb6c The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in decoris (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973 The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

MAL-2026-14554 Malicious code in decoris (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973 The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

Malicious Package

Overview roblox-api-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

MAL-2026-11050 Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

MAL-2026-10925 Malicious code in tilaver-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...

Trusting your kids online isn’t enough (Lock and Code S07E14)

This week on the Lock and Code podcast … There is a lot going on right now regarding the safety of kids online. In the United States, the majority of state legislatures have passed age verification laws requiring a variety of websites to more rigorously verify the age of their visitors. In the...

Malicious code in roblox-lua-promise (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7405 Malicious code in roblox-lua-promise (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in fsociety-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88731d75288f663967fc64dde12b04eb43a2eb3d4113486bf35b1cf3d89ae537 On import, fsocietytools/init.py loads tokens.py, which at module load time instantiates TokenManager. The constructor concatenates eight large strin...

MAL-2026-6549 Malicious code in discord-token-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebd016cfcb52b59c0141268099b96c1336a15ca1d0afce46f367c7fe376f57de discordtokengenerator/init.py imports tokens.py, which instantiates TokenManager at module load. The constructor calls notin, which concatenates eigh...

MAL-2026-6504 Malicious code in openblox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd874a78973f84b5373fc03a48472c338ca82ef0a258b7614f81a8359da1201 setup.py invokes GetGitCommitHash unconditionally at module top level, so it runs on pip install openblox and any setuptools invocation. On Windows t...

Malicious code in openblox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd874a78973f84b5373fc03a48472c338ca82ef0a258b7614f81a8359da1201 setup.py invokes GetGitCommitHash unconditionally at module top level, so it runs on pip install openblox and any setuptools invocation. On Windows t...

A week in security (June 15 – June 21)

Last week on Malwarebytes Labs: Nearly 15,000 infected websites cleaned in SocGholish crackdown Apple patches Beats Studio Buds flaw that could turn earbuds into a wiretap Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control Retro gaming fans are the new target for fake...

MAL-2026-6128 Malicious code in abuden218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e1df12b592dc442d5266d4244831fd0b6ceb94c0960a26815f5fad3246b828 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...