MAL-2026-18442 Malicious code in litecore-lib-ltc (npm)

Malicious package. litecore-lib-ltc is a typosquat of the legitimate litecore-lib Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API api.blockcypher.com to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to a...

Fake iPhone Duo preorder scam triggers DarkSword attack

Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of the iPhone Duo and iPhone 18 Pro was familiar fraud. But one fake preorder page was different. The fake Apple-style page offers...

CVE-2026-78391

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391

RansomLook contains a stored XSS in its cryptocurrency wallet detail view. Untrusted cryptocurrency addresses and blockchain names—sourced from external feeds such as the public ransomwhe.re crowd-sourcing feed—were stored without sufficient validation and rendered inside an inline JavaScript onc...

CVE-2026-78391: Improper Neutralization of Input During Web Page Generation

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

PT-2026-80895

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

Malicious code in arb-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30 arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry index.js contains an IIFE that, 37 seconds after require, reads a base64...

MAL-2026-13749 Malicious code in base65-33x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b Package name resembles the popular base-x encoder/decoder. The exported decodestring function in both CJS and ESM entrypoints POSTs its caller-suppli...

Malicious code in camelot-ammv2-periphery (npm)

camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...

Malicious code in camelot-ammv2-core (npm)

camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the...

MAL-2026-13773 Malicious code in camelot-ammv2-periphery (npm)

camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

MAL-2026-13772 Malicious code in camelot-ammv2-core (npm)

camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the...

Malicious code in btcflip (PyPI)

Source: kam193 2b305ae4851e877fcea4950e019342d31782bde7e3c49d11847e2ede65776f78 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-kotanku Reasons based on the campaign: -...

Malicious code in kotoraka (PyPI)

Source: kam193 e9ba78f7ee9a259fc6e518295fe3d0217c83808bbdf0fff2107883cb3cf50b3c During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-kotanku Reasons based on the campaign: -...

Malicious code in btcflx (PyPI)

Source: kam193 504aca220be0f03b6572f62dc3fc4a49ace09be61a969e39713c890f28afe62a During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-kotanku Reasons based on the campaign: -...

Malicious code in kotoraka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...

MAL-2026-13667 Malicious code in kotanku (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281ff1cf735f26084f13f5f3ef5e1d5f9faf8cf06254532e5ee6d27204f52d1 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in pydanticc (PyPI)

Source: kam193 c16b176d1ba6ee3f4f1680d0678c9933e620f4de18bec7bc9af67978ed737527 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

Malicious code in flasq (PyPI)

Source: kam193 2498f9d207b216ad7438cd262c9136cc5453d288f97a74d4cd44a9a2accf9141 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...