Malicious code in express-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aea7dd76028cd443cf2f8d58fa5d8b3b28bb6db870f34d1cc6dad28db92fe93 [email protected] typosquats the express framework: package.json copies express's description, author TJ Holowaychuk, repository expressjs/express...

Malicious code in exprdd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd27ec488e87cd2e26c940ac161033475731708a3f2ae629c4a138275b520f9 [email protected] impersonates the express framework — package name, description, author, contributors, repository, homepage, and keywords are copied...

of-CORS

of-CORS of-CORS es el conjunto de herramientas de Truffle Security para identificar y explotar configuraciones incorrectas de CORS en redes internas de objetivos de bug bounty mediante typosquatting. Puedes leer más aquí https://trufflesecurity.com/blog/of-CORS ¿Cómo funciona? of-CORS es una...

sloppy-joe

Catch hallucinated, typosquatted, and non-canonical dependencies before they reach production. cargo install sloppy-joe TheLiteLLM supply chain attack March 2026 compromised a package with 97M monthly downloads. Attackers stole publishing credentials, pushed malicious versions that harvested SSH...

antisquat

AntiSquat AntiSquat leverages AI techniques such as natural language processing NLP, large language models ChatGPT and more to empower detection of typosquatting and phishing domains. How to use Clone the project via git clone https://github.com/redhuntlabs/antisquat. Install all dependencies by...

antisquat

AntiSquat AntiSquat aprovecha técnicas de inteligencia artificial como el procesamiento del lenguaje natural NLP, grandes modelos de lenguaje ChatGPT y más para potenciar la detección de dominios de typosquatting y phishing. Cómo usar Clona el proyecto mediante git clone...

opensquat

openSquat Core 📑 Table of Contents What is openSquat? Featured In Open-Core Model Key Features Quick Start Requirements Usage Premium and API Modes Configuration Automation CLI Reference Contributing Author License 🎯 What is openSquat? openSquat is an Open Source Intelligence OSINT security tool...

go-get-RCE

go-get-RCE This is the exploit of CVE-2018-6574: go get RCE This vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system installing their malicious library. This is a good example of a vulnerability that can be exploited using typosquatting to gain co...

dnstwist

Descubre en qué tipo de problemas pueden meterse los usuarios al intentar escribir tu nombre de dominio. Encuentra dominios similares que los adversarios pueden usar para atacarte. Puede detectar typosquatters, ataques de phishing, fraude y suplantación de marca. Útil como fuente adicional de...

jeopardize

Introducción La herramienta Jeopardize está desarrollada para proporcionar capacidades básicas de inteligencia y respuesta contra amenazas de dominios de phishing al mínimo costo posible. Detecta candidatos a dominios de phishing registrados typosquatting, homógrafos, etc., los analiza y les asig...

Supply-Chain

Seguridad en la Cadena de Suministro de Software Una serie completa de tres libros sobre seguridad en la cadena de suministro de software, que cubre amenazas, defensas y gobernanza. Este manuscrito de código abierto proporciona a profesionales de seguridad, desarrolladores y líderes...

aura

Este repositorio se ha trasladado a una nueva ubicación: https://github.com/SourceCode-AI/aura Seguridad en auditoría e introspección de código Sobre el problema La tendencia actual en el desarrollo es utilizar muchos paquetes en la fase de desarrollo, incluso si proporcionan solo una funcionalid...

CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Hook malicioso de instalación de paquetes PyPI ejecución de setup.py Código del programa Python setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup name='harmless-pkg',...

Malicious code in starlette-healthchecks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eebffb3f581b979c3e9a1dc0aef347111b50922326b2181cc9d2bc009c4e7021 The package advertises itself as ASGI healthcheck/logging middleware, but its documented entry point configurelogging re-exported from...

MAL-2026-16356 Malicious code in starlette-healthchecks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eebffb3f581b979c3e9a1dc0aef347111b50922326b2181cc9d2bc009c4e7021 The package advertises itself as ASGI healthcheck/logging middleware, but its documented entry point configurelogging re-exported from...

Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

MAL-2026-16143 Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

MAL-2026-16127 Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...