China-linked LapDogs Campaign Drops ShortLeash Backdoor with Fake Certs

ShortLeash backdoor, used in the China-linked LapDogs campaign since 2023, enables stealth access, persistence, and data theft via compromised SOHO routers and fake certs...

Malicious code in react-smooth-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7510dd029031b29ab209e3114deb48a7ad72b83c7d10073376637b71e89abf7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5226 Malicious code in fix3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a570744f3eb415e9f6dc103a46162807ae15fcf346c531393ee20268c83b660c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5221 Malicious code in art19-web-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 833f7a38c823fdd26727d7a6aec9c75365b96860e4723badca46db54163128da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in localstorage-retry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2eccc1f61f6a4e5f1c34925b0fe72e4660688f0f1fd594933cc71c605b3ceaa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in websdk-colours (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 525b4f90e12d0654f3383e01859016dab00f6bbab39b2d38eeb165bb8f09b63e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in portal-frontend-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7318f2ff74b7adb55b31d5c2c7e7a7ad130d5d5796972ed5464beaf9e0b6312f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 84f2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0ef9e3591e3cb17182faacefb3f777ffaf4641a073cabc5c87226a2b9e7d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5229 Malicious code in k00h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8611181e62dbbb17a96abd393d71602a8ab52b9197629fe1d8724413c128de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5219 Malicious code in 84f2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0ef9e3591e3cb17182faacefb3f777ffaf4641a073cabc5c87226a2b9e7d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in by-category (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33dcda1b7529d698b9f0ef716b79ce2d398c3e9645ea0e6514fc6a6580ee9df2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5223 Malicious code in by-category (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33dcda1b7529d698b9f0ef716b79ce2d398c3e9645ea0e6514fc6a6580ee9df2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5227 Malicious code in gs_isotope-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc9cf2e5331d05d054643fdf750024a8608fd9527d09ee3b9f0ce18a0a424064 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5230 Malicious code in localstorage-retry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2eccc1f61f6a4e5f1c34925b0fe72e4660688f0f1fd594933cc71c605b3ceaa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5238 Malicious code in websdk-colours (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 525b4f90e12d0654f3383e01859016dab00f6bbab39b2d38eeb165bb8f09b63e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5217 Malicious code in nf-cl-logger-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f9af3e16698ffb1e46af4d45f8b046c0ac49c6e277db7b769a831468aa92894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5231 Malicious code in masonry-thingies.js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e70accfc2426ff18c07044dbff04eb2751b242ea1db0e71907cba610a17da65b Any computer that has this package installed or running should be considered...

Malicious code in pretty-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38d0eefdd1fa3df5fae851db7bb5244936969879bfe0651e61530cf72dd6026a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nitro-contracts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcfdc095311c01986f57ec3730d8e3600f3c83ffb5fc23c500a51eed38ea048d Any computer that has this package installed or running should be considered...

MAL-2025-5215 Malicious code in mydummyproject-zyp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7385c16c060ed95f15f1eed55e51d69f17bc1768a7ed955da163b7e314b62df Any computer that has this package installed or running should be considered...