Malicious code in caoxiltts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in voxcpmui3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in voxcpmtts3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-17457 Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

redtail-ioc

redtail-ioc Индикаторы компрометации и скрипт для триажа с Linux-сервера, который я администрировал и который был взломан в июле 2026 года. Это не была элитная ошибка. Это была банальная оплошность, обнародованная, потому что стыд полезнее, когда он подкреплён логами. Я бы не заметил этого, если ...

MALW

CVE-2007-4559 - эксплойт Polemarch Полностью рабочий эксплойт для сервера Polemarch https://www.polemarch.org/, использующий CVE-2007-4559 и позволяющий: Внедрение криптомайнера для monero с использованием TOR для лучшего скрытия. Внедрение руткита, нацеленного на наиболее распространённые...

Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

MAL-2026-15878 Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

MAL-2026-14388 Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

MAL-2026-14384 Malicious code in mlflow-otel-instrumentor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b08cc23ea60cf80f9bf13850e8222ee1cbb7a89643362c703eb402eef08d908c Package metadata impersonates AWS author "AWS Support Team", email [email protected], homepage https://aws.amazon.com/ while the actual payload is...

Malicious code in mlflow-otel-instrumentor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b08cc23ea60cf80f9bf13850e8222ee1cbb7a89643362c703eb402eef08d908c Package metadata impersonates AWS author "AWS Support Team", email [email protected], homepage https://aws.amazon.com/ while the actual payload is...

Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

MAL-2026-14064 Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

MAL-2026-11197 Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83 On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 usi...

Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83 On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 usi...

MAL-2026-10985 Malicious code in animated-octo-spoon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54ed87d7e17e6be9f6e7c22f4f008e7a6326253127248f2c14f8a19390ac31 animated-octo-spoon 0.1.0 ships a 2.6MB Linux ELF binary named 'forge' a Rust-compiled CUDA GPU miner plus a launcher script start.sh. The package's...