BadBlood

BadBlood BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

CVE-2026-89178

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

CVE-2026-89178

WeenyGenius , a computer lab management system by Howyar Technologies , suffers from an Origin Validation Error that allows unauthenticated attackers on the same network to spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection wit...

CVE-2024-24409

CVE-2024-24409 - Vulnerabilidad de Elevación de Privilegios en ADManager Plus Build 7210 Descripción Modificar Equipos es un rol predefinido en ADManager para gestionar equipos. Si un usuario técnico tiene el privilegio Modificar Equipos sobre un equipo, puede cambiar los atributos...

Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56afa18eac7769497f21431af2a739dd5040563541223e41786746e0c44957a2 Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetching remote content, no...

Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

Malicious code in svelte-mapped-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666d747ec06fa428dfb0f21867e6001b52450fee1770061dcd9bd0ec9e3731fa [email protected] shows no evidence of credential access, install-time or import-time code execution from remote sources, silent relay of...

MAL-2026-13385 Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

MAL-2026-12026 Malicious code in cors-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e391c8883796e10e6d74a96311f18f2a083b2745a6bd6cae8a3d7acc61d277 The CommonJS entry src/index.cjs exports getPlugin, which performs an HTTPS GET to the hardcoded host astonishing-torrone-ffb31e.netlify.app with TLS...

MAL-2026-12027 Malicious code in tailwind-anime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd7605f83f25074e67fa0c72679d47f50fe781dae40e4560ee0a216e91320014 [email protected] is a typosquat of tailwindcss-animate. Its index.js appends an evalatob'...' blob that runs whenever the plugin is required e.g....

MAL-2026-12010 Malicious code in @keyv/compress-gzip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca4a62f75f4ef4696136cf194317102ad13aa319ba3319fb7dce12de6ae8e9d @keyv/compress-gzip is a gzip compression adapter for the keyv key-value storage library. No static or behavioral indicators of credential access,...

MAL-2026-12011 Malicious code in @keyv/compress-lz4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7fac64e01bf267ca0ee1c3234782fd17c24865d3be3e0cbfa26b65fe83c1a3 Package is an LZ4 compression adapter for the keyv key-value store. The dist bundles dist/index.cjs and dist/index.mjs contain Buffer.from...,...

Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

MAL-2026-12022 Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

Malicious code in accounts-loading-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d430e8d55d80c0cf747e6c04058e0bc90274cc943a0e6e15651924c90be46d2 On require of accounts-loading-state, index.js loads setup.js which schedules bootstrap via process.nextTick. bootstrap detects OS and architecture,...

Malicious code in beaver-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465b05640a3068a007c565655d946564a39211eeca92f8637b7c3b4fe9c9dece The package is advertised as a React UI layout library but on require'beaver-ui-layout' loads bridge.js, which reconstructs hostnames from array-join...

Malicious code in tailwind-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0 index.js appends an evalatob... blob to an otherwise legitimate Tailwind plugin. On require, the decoded loader queries Ethereum JSON-RPC block...