reconpal

ReconPal: Leveraging NLP for Infosec Recon is one of the most important phases that seem easy but takes a lot of effort and skill to do right. One needs to know about the right tools, correct queries/syntax, run those queries, correlate the information, and sanitize the output. All of this might ...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

rekono

Automate the recon, keep your time for the part that actually needs a hacker Think about how an assessment really starts. You gather public information about the target. You discover its hosts, enumerate their ports and identify the services behind them. Then you run a more specific tool against...

Malicious code in boto4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa setup.py defines a custom setuptools install command EjecutaElf that base64-decodes a 17MB embedded Linux ELF, writes it to /tmp/.systemd-helper,...

MAL-2026-14349 Malicious code in boto4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa setup.py defines a custom setuptools install command EjecutaElf that base64-decodes a 17MB embedded Linux ELF, writes it to /tmp/.systemd-helper,...

Malicious code in infogram-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...

MAL-2026-14131 Malicious code in infogram-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...

MAL-2026-14130 Malicious code in httpz-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc httpz-requests exposes a Telegram bot startbot, runcmdenc, httprequest whose message handler executes arbitrary shell commands on the host running th...

MAL-2026-13682 Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...

Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...

Malicious code in btcflip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...

MAL-2026-13681 Malicious code in btcflip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...

MAL-2026-13683 Malicious code in kotoraka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...

Malicious code in kotoraka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-13258 Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

MAL-2026-11516 Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...