Malicious code in sap-mcp-facilitator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8470f17eabef0f8e78467a643e0bcd4598174a0647c241145e3a7a857156a64 lib/report.js collects the installer's developer identity — os.userInfo.username, os.hostname, and the git/GitHub email invoking gh api user/emails...

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted...

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators. Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology...

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...

Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A...

WordPress Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter vulnerability

Unauthenticated Authentication Bypass via Hardcoded Backdoor in 'wplogin' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Advanced Responsive Video Embedder versions 10.8.7...

CVE-2026-18072

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arveucinit function — registered on WordPress's init hook at priority 1 so...

CVE-2026-18072

CVE-2026-18072 is a supply-chain backdoor in the WordPress plugin “Advanced Responsive Video Embedder” (version 10.8.7). The root cause, as reported by Wordfence, is a hardcoded master credential used by the internal function _arve_uc_init() to bypass authentication. The backdoor accepts a token ...

EUVD-2026-50111

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arveucinit function — registered on WordPress's init hook at priority 1 so...

CVE-2026-18072 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the arveucinit function — registered on WordPress's init hook at priority 1 so...

MAL-2026-11125 Malicious code in api-rust-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlle...

Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497 The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoParseDate function invokes...

MAL-2026-11000 Malicious code in application-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fa5354b40e3efac6ff8738892aa26cb710e6aff3caca516f563502ef4a4d43 On npm install, scripts.postinstall runs test.js which performs three attacker-beneficial actions against the installer's host. 1 Backdoor: fetches a...

MAL-2026-11003 Malicious code in n8n-nodes-net-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0 The package advertises itself as an n8n community 'Network Utils' node, but its main entry index.js is an IIFE that executes on require. On load it: ...

MAL-2026-11005 Malicious code in n8n-nodes-quick-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive she...

MAL-2026-11006 Malicious code in n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9256e5f20f66f3eb9875dcc475299249173730d784230eb157c327171d114e21 The package advertises itself as an n8n community node 'Utility nodes for n8n', but the declared community node file MyNode.js is an empty stub and t...

New ClickLock Stealer locks your Mac until you hand over your password

ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...

MAL-2026-10977 Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaa5c1d1ed763b9e392bd199c360d75b25531b287de9f224e5626e121d649d4 Analysis of lebinfmt 1.0.0 surfaced no behaviors matching supply-chain attack classes. No install-time or import-time network I/O, no credential or...

Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaa5c1d1ed763b9e392bd199c360d75b25531b287de9f224e5626e121d649d4 Analysis of lebinfmt 1.0.0 surfaced no behaviors matching supply-chain attack classes. No install-time or import-time network I/O, no credential or...

Malicious code in rasterkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b The rasterkit 1.0.2 distribution installs its modules under the top-level PIL/ package name owned by Pillow. toplevel.txt declares PIL and the wheel'...