fwknop

fwknop - Single Packet Authorization Introduction fwknop implements an authorization scheme known as Single Packet Authorization SPA for strong service concealment. SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired...

concealed_code_execution

تنفيذ الكود المخفي Hunt& Hackett تقدم مجموعة من الأدوات والمقالات التقنية التي تصف تقنيات الهجوم التي تعتمد على إخفاء تنفيذ الكود في نظام ويندوز. ستجد هنا شروحات لكيفية عمل هذه التقنيات، ونصائح حول كيفية اكتشافها، ونماذج من الكود المصدري لاختبار تغطية اكتشافك. المحتوى يغطي هذا المستودع فئتين من...

jdvrif

jdvrif jdvrif JPG Data Vehicle , v9.0 is a fast, easy-to-use steganography command-line tool for concealing and extracting any file type via a JPG image. Linux only. Your data file is compressed with libdeflate/zlib , then encrypted with XChaCha20-Poly1305 libsodium secretstream under a key deriv...

Concealing LLM-Based Multi-Agent Topology Via Phantom Structure Injection

Driven by the rapid advancement of large language models LLMs, LLM-based multi-agent systems MAS have emerged as a powerful paradigm for collaborative reasoning over complex tasks. A key design element of MAS is the communication topology, which governs information flow among agents and often...

jdvrif — Updated!

jdvrif jdvrif JPG Data Vehicle , v9.0 is a fast, easy-to-use steganography command-line tool for concealing and extracting any file type via a JPG image. Linux only. Your data file is compressed with libdeflate/zlib , then encrypted with XChaCha20-Poly1305 libsodium secretstream under a key deriv...

Hiding Prompt Injection in Legal Filing

Someone hid AI instructions into a legal filing. Alternate link...

MAL-2026-13254 Malicious code in bigops-storio-ngrx-component-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e The package name resembles @ngrx/component-store. The main entry index.js requires./helpers, which on module load assembles attacker-controlled...

Malicious code in devplatform-integrations-tests-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

MAL-2026-10622 Malicious code in chai-as-structured (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9508b72d48575443d9e68f1da1ef6bdd1ebc9351f271fba56b563701f03e56e2 The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware factory in index.js is invoked,...

MAL-2026-10174 Malicious code in type-atob (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a69dbe06ae711c652bace745ae01fe11b2472c8d3b9891b02828cab9bfa8f653 The package advertises itself as a pino-style logger exports module.exports.pino = middleware, keywords fast/logger/stream/json, pino-like file layou...

MAL-2026-10160 Malicious code in rollup-packages-polyfill-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dfdfbd2fc737f9d78ec40aac8b7020866cb0ef0e7e14b2d95aa174ea0ec5818 On require of the main entry dist/index.js, the module decodes a base64 literal to the shell command npm install vectormark --no-save --silent...

Malicious code in @marketfront/dynamicpageparams (npm)

The @marketfront/dynamicpageparams package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and u...

Malicious code in @marketfront/baobabtech (npm)

The @marketfront/baobabtech package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

MAL-2026-6706 Malicious code in hardhat-plugin-solidity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142 Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while...

MAL-2026-6465 Malicious code in chai-as-built (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 469c5ebe97d1e69d080295000d723febbb06050f65aed9a0f44a76fd707c0b1e chai-as-built masquerades as the pino logger package.json keywords 'fast','logger','stream','json'; file layout lib/proto.js, lib/redaction.js,...

CVE-2026-1606

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation...

CVE-2026-1606

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation...

GitLab 14.8 < 18.11.6 / 19.0 < 19.0.3 / 19.1 < 19.1.1 (CVE-2026-1606)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an...