MINI-45C2-FJG9-5WFX

Bulletin has no description...

MINI-C2CH-JW2P-XXP4

Bulletin has no description...

Malicious code in dxrs-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...

Malicious code in dxr-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an...

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a...

Malicious code in @oyo_tech/oyochat_user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e @oyotech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e...

Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Cybersecurity researchers have traced the continued evolution of the Cavern aka Cav3rn command-and-control C2 framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster...

MINI-C229-GMPV-J6GX

Bulletin has no description...

MAL-2026-14065 Malicious code in akamai-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...

Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

MAL-2026-14052 Malicious code in require-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...

Malicious code in vexium-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...

Malicious code in @kolbo/mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...

Malicious code in date-fmt-helper-xz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b384650ec0fabdd01a7dfc513cccd25156611a04c17ba0c435b950ddb9215777 date-fmt-helper-xz ships a postinstall.js that runs automatically on npm install. The script opens a TCP connection to the hardcoded remote host...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

MAL-2026-13955 Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

MAL-2026-14018 Malicious code in bs58-77 (npm)

npm/bs58-77 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-77x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency declar...