neurax

A framework that aids in creation of self-spreading software Overview With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers. Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code package main...

Malicious code in dependent-final (npm)

Part of a self-republishing campaign: the package ships test.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry...

Malicious code in wet_rat_replicate_automation (npm)

Part of a self-republishing campaign: the package ships autopublish2.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a...

Malicious code in quiche-tea-curut (npm)

Part of a self-republishing campaign: the package ships autopublish2.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a...

Malicious code in unemployed_xerinae-toolteadev (npm)

Part of a self-republishing campaign: the package ships auto.js, which in a loop gives the package a new random name, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry worm and fills the...

Malicious code in pearx93qja-notthedevs (npm)

Part of a self-republishing campaign: the package ships autochange2.js, which in a loop gives the package a new random name, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry worm and fill...

Malicious code in low_hummingbird_replicate_automation (npm)

Part of a self-republishing campaign: the package ships autopublish3.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a...

Malicious code in related_blackbird-toolteadev (npm)

Part of a self-republishing campaign: the package ships auto.js, which in a loop gives the package a new random name, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry worm and fills the...

Malicious code in peas-tea-curut (npm)

Part of a self-republishing campaign: the package ships autopublish2.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a...

Malicious code in maila-talijah-alpha-128 (npm)

Part of a self-republishing campaign: the package ships loop.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry...

Malicious code in dian-peyek23-miaww (npm)

Part of a self-republishing campaign: the package ships auto.js, which in a loop gives the package a new random name, bumps its version, rewrites package.json and runs npm publish to publish the package again under the new name. Self-replicating publication is the propagation step of a registry...

rvbbit-arsenal

RVBBIT Arsenal: The Ultimate Offense & Defense Duality Overview This repository houses two sides of the same coin: attack/ – Project RVBBIT, a classic Linux kernel rootkit with embedded miner and network worm. defense/ – RvbbitSafe, the definitive countermeasure that detects, neutralizes, and...

Malicious code in sound_deer_apricot-15 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in unfortunate_crawdad_emerald-79 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in valid_antlion_amber-50 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in temporary_smelt_lavender-81 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in pure_opossum_amaranth-54 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in itchy_gecko_magenta-98 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in intimate_ostrich_amethyst-45 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in xenacious_kangaroo_blush-47 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...