48185 matches found
MAL-2026-6149 Malicious code in backgroundprocessing-contextmenus (npm)
The npm package backgroundprocessing-contextmenus published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
MAL-2026-6170 Malicious code in onesignal-hooks (npm)
The npm package onesignal-hooks published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...
MAL-2026-6180 Malicious code in userinterface-machinelearning (npm)
The npm package userinterface-machinelearning published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
MAL-2026-6148 Malicious code in async-protobuf-av (npm)
The npm package async-protobuf-av published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...
MAL-2026-6163 Malicious code in framerate-interaction-permissions (npm)
The npm package framerate-interaction-permissions published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
Malicious code in streaming-downloads (npm)
The npm package streaming-downloads published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...
Malicious code in touchid-images (npm)
The npm package touchid-images published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...
MAL-2026-6172 Malicious code in platformspecific-webgl (npm)
The npm package platformspecific-webgl published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...
MAL-2026-6181 Malicious code in virtualization-compression-collapse (npm)
The npm package virtualization-compression-collapse published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
MAL-2026-6179 Malicious code in touchid-images (npm)
The npm package touchid-images published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...
MAL-2026-6158 Malicious code in enzyme-optimization-bluetooth (npm)
The npm package enzyme-optimization-bluetooth published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
Malicious code in interaction-photos-infinitescroll (npm)
The npm package interaction-photos-infinitescroll published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
MAL-2026-6161 Malicious code in flexbox-oauth-machinelearning (npm)
The npm package flexbox-oauth-machinelearning published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...
binutils:fuzz_objdump_safe: Heap-buffer-overflow in byte_get_little_endian
Detailed Report: https://oss-fuzz.com/testcase?key=6367976782364672 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzobjdumpsafe Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7afd389e048c Crash State: bytegetlittleendian...
assimp:assimp_fuzzer: Use-of-uninitialized-value in Assimp::LWOImporter::CopyFaceIndicesLWO2
Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5264547070672896 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzermsanassimp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
binutils:fuzz_objdump: Stack-buffer-overflow in buffer_read_memory
Detailed Report: https://oss-fuzz.com/testcase?key=4794266673807360 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzobjdump Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 8 Crash Address: 0x778d11e07f54 Crash State: bufferreadmemory...
libredwg:llvmfuzz: Index-out-of-bounds in dwg_encode
Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4550120497807360 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerubsanlibredwg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...
MAL-2026-5978 Malicious code in cryptodao-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...
Malicious code in cryptodao-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...
