xz-vulnerable-honeypot

xz-vulnerable-honeypot An ssh honeypot with the XZ backdoor. CVE-2024-3094 TODO : hook the backdoor and/or sshd. log rsa keys for decryption. notes: https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504 https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components. The XZ Backdoor: A Supply‑Chain Threat that Reaches...

xzwhy

xzwhy / / / / \ / /\ This project is a Kubernetes-friendly Proof of Concept POC for CVE-2024-3094 affecting XZ Utils. See this article for an excellent walkthrough of the exploit's provenance and mechanics. WARNING ⚠⚠⚠ Running any of the commands below may result in the deployment of a vulnerable...

zeek-spicy-facefish

FacefishRootkit This Zeek+Spicy analyzer will detect the Facefish Linux rootkit C2 as described in: https://blog.netlab.360.com/sshstealerfacefishen/ https://blogs.juniper.net/en-us/threat-research/linux-servers-hijacked-to-implant-ssh-backdoor...

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

In this article 1. Attack chain overview 1. Attack chain 2. Host reconnaissance collection 3. SSH authorization and tunnel identities 4. Protocol Tunneling T1572: reverse SSH forwarding 5. Platform-specific startup persistence 2. Mitigation and protection guidance 1. Immediate actions 2...

CVE-2024-3094-backdoor-env-container

CVE-2024-3094 SSH Backdoor Container Env This is an environment running CVE-2024-3094 sshd backdoor instance, working with this exploit: https://github.com/amlweems/xzbot. Experiments Test in Docker IT IS NOT a Docker container. I had tried making this vulnerability env with docker but failed: 1...

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, dock...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13874 Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13875 Malicious code in @years17/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8 The package's postinstall script duplicated in index.js runs automatically on npm install and performs three malicious actions: 1 executes...

MAL-2026-13847 Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

Malicious code in api-rust-sdk (npm)

Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlled SSH public key from http://95.216.118.146:3001/api/ssh-k...

Malicious code in @solarcraft/observix (npm)

Source: amazon-inspector 14c39608a172a624520f309b572b40636dc51563f85fe89dac968712490dd40f The package advertises itself as a zero-dependency colorized logger similar to pino-pretty, but dist/index.js does require'./logger' purely for its top-level side effects. On import, dist/logger.js executes ...

Malicious code in portloop (npm)

Source: amazon-inspector e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c On default invocation e.g., npx portloop with no flags, the CLI runs in daemon+quiet+respawn mode and POSTs id, hostname, host, url, port, user to a hardcoded Cloudflare Worker registry at...

Malicious code in polymarket-mcp-v2 (npm)

Source: amazon-inspector cbccd8ee43d5fefa17eb83c5528b66a52315351a404aa54c4a32d1af0dbf238e The package's postinstall hook loads index.js and executes routines that 1 recursively scan the install directory for id.json,.env, env, config.toml and Config.toml and POST their contents to...

Malicious code in textwrap-ext (PyPI)

Source: kam193 da4e8d5daae9a14e0ceb5a942afd308068957ec655cdd950b2b041934e9ec182 During installation, obfuscated code exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new authorized SSH key. Information about the placed backdoor is sent back to the...

Malicious code in textwrap-toolkit (PyPI)

Source: kam193 029e190fc99763d65a096339b29fa85aeb0a23c3818a632a2dd4dc99f3e8fd64 During installation, obfuscated code exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new authorized SSH key. Information about the placed backdoor is sent back to the...

Malicious code in rasterkit (PyPI)

Source: kam193 a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875 This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an SSH backdoor. --- Category: MALICIOUS - The campaign has...