CredsLeaker

CredsLeaker v4.x A big shoutout to @ApSecDev who took this project to the next level! Kudos! This script used to display a powershell credentials box asked the user for credentials. However, That was highly noticeable. Now it's time to utilize Windows Security popup! Features AD domain...

TurkoRat

TELEGRAM VERSION ⚔️ TurkoRat 🛡️ Telegram server: https://t.me/turcoflex Discord server: https://discord.gg/xTsJReFG84 joinnew discord 🌐 〢 Content 📁 Setting up ⚔️ Features 📸 Screenshots 📝 Todo 📜 License ⚠️ Note 📁 〢 Setting Up Install Node.js IMPORTANT: When installing Node.js also install "Tools for...

RunAs-Stealer

RunAs-Stealer RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging Usage The stealers are running in a while loop the injector also in Hooking case in the background, to kill them use Task Manager. The stolen credentials...

Malicious code in @brick-v2/tour (npm)

Source: amazon-inspector aabec40c085d56f59b4ca696eefe600f450a03284df0d77f562d861fed091bee The package presents itself as an Angular-style module exposing forRoot/createLogger stubs and a version field, but these exports are no-ops. The real behavior is in a bundled prebuilt native addon at...

Malicious code in @brick-v2/icons (npm)

Source: amazon-inspector 915977ddb276c313e2977875d853dfba4eebd12f75ad0826008866b5059c68a8 @brick-v2/[email protected] is a dependency-confusion credential stealer. The package's package.json declares a preinstall script node index.js, and index.js's only behavior is to require a platform-specific...

Malicious code in @brick-v2/tour (npm)

@brick-v2/tour is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

MAL-2026-17717 Malicious code in @brick-v2/icons (npm)

@brick-v2/icons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @brick-v2/icons (npm)

@brick-v2/icons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

MAL-2026-17719 Malicious code in @brick-v2/tour (npm)

@brick-v2/tour is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in base58-check-helper (RubyGems)

RubyGems runs this gem's native extension script ext/base58-check-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...

MAL-2026-17580 Malicious code in base58-check-helper (RubyGems)

RubyGems runs this gem's native extension script ext/base58-check-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...

Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

MAL-2026-17224 Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index PyPI repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and...

Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

MAL-2026-15995 Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

MAL-2026-15559 Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

PT-2026-86430

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

MAL-2026-14485 Malicious code in secretkey-2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd Package presents itself as a zero-dependency TOTP library but its postinstall hook node lib/core.js and its advertised validateSecret API both trigge...