Malicious code in @brick-v2/tour (npm)

Source: amazon-inspector aabec40c085d56f59b4ca696eefe600f450a03284df0d77f562d861fed091bee The package presents itself as an Angular-style module exposing forRoot/createLogger stubs and a version field, but these exports are no-ops. The real behavior is in a bundled prebuilt native addon at...

Malicious code in @brick-v2/icons (npm)

Source: amazon-inspector 915977ddb276c313e2977875d853dfba4eebd12f75ad0826008866b5059c68a8 @brick-v2/[email protected] is a dependency-confusion credential stealer. The package's package.json declares a preinstall script node index.js, and index.js's only behavior is to require a platform-specific...

MAL-2026-17717 Malicious code in @brick-v2/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 915977ddb276c313e2977875d853dfba4eebd12f75ad0826008866b5059c68a8 @brick-v2/[email protected] is a dependency-confusion credential stealer. The package's package.json declares a preinstall script node index.js, and...

TurkoRat

ВЕРСИЯ ДЛЯ TELEGRAM ⚔️ TurkoRat 🛡️ Сервер Telegram: https://t.me/turcoflex Сервер Discord: https://discord.gg/xTsJReFG84 присоединяйтесь к новому Discord 🌐 〢 Содержание 📁 Настройка ⚔️ Функции 📸 Скриншоты 📝 Планы 📜 Лицензия ⚠️ Примечание 📁 〢 Настройка Установите Node.js ВАЖНО: При установке Node.js...

CredsLeaker

CredsLeaker v4.x Un grand merci à @ApSecDev qui a porté ce projet au niveau supérieur ! Bravo ! Ce script affichait auparavant une boîte de dialogue PowerShell demandant les identifiants à l'utilisateur. Cependant, C'était très visible. Il est maintenant temps d'utiliser la popup de sécurité...

RunAs-Stealer

RunAs-Stealer Voleur d'identifiants de l'utilitaire RunAs implémentant 3 techniques : Hooking de CreateProcessWithLogonW, Keylogging intelligent, Débogage à distance Utilisation Les stealers s'exécutent dans une boucle while l'injecteur également dans le cas du Hooking en arrière-plan, pour les...

MAL-2026-17580 Malicious code in base58-check-helper (RubyGems)

RubyGems runs this gem's native extension script ext/base58-check-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...

Malicious code in base58-check-helper (RubyGems)

RubyGems runs this gem's native extension script ext/base58-check-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...

MAL-2026-17224 Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index PyPI repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido, SafeDep, Socket, and...

Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

MAL-2026-15995 Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

MAL-2026-15559 Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

PT-2026-86430

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

MAL-2026-14485 Malicious code in secretkey-2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd Package presents itself as a zero-dependency TOTP library but its postinstall hook node lib/core.js and its advertised validateSecret API both trigge...

Malicious code in secret-key-totp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6 [email protected] declares a postinstall hook node./index.js --setup that executes a credential stealer and dropper on install, and the same...

MAL-2026-14255 Malicious code in secp256k1-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main index.js is a singl...

Malicious code in tailwind-utility-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to...