Malicious code in caoxiltts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in voxcpmui3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in voxcpmtts3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-17457 Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

redtail-ioc

redtail-ioc 2026년 7월에 침해당한 제가 운영하는 Linux 서버의 침해 지표IOC와 분류triage 스크립트입니다. 정교한 실패가 아니었습니다. 기본적인 실수였고, 수치심은 로그와 함께 있을 때 더 유용하기 때문에 공개적으로 인정합니다. 그쪽도 멍청한 실수를 하지 않았더라면어쩌면 눈치채지 못했을 ssh 잠금 저도 이걸 발견하지 못했을 겁니다. 저는 몇몇 분야에서는 제법 할 줄 알지만, 여기서는 경험이 거의 없습니다. 로봇들에게 물어봐야 했습니다. Fable은 놓쳤지만 Codex 5.5가 진행 중인 침해를...

MALW

CVE-2007-4559 - Polemarch 익스플로잇 Polemarch 서버 https://www.polemarch.org/ 에 대한 완전한 작동 익스플로잇, CVE-2007-4559를 사용하여 다음을 가능하게 합니다: 더 나은 은닉을 위해 TOR를 사용하는 모네로 암호화폐 채굴기 주입 가장 일반적인 시스템 관리 도구를 대상으로 하는 루트킷 주입 POC https://vulners.com/cve/CVE-2007-4559 를 사용한 개념 증명이며,...

Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

MAL-2026-15878 Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

MAL-2026-14388 Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

MAL-2026-14384 Malicious code in mlflow-otel-instrumentor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b08cc23ea60cf80f9bf13850e8222ee1cbb7a89643362c703eb402eef08d908c Package metadata impersonates AWS author "AWS Support Team", email [email protected], homepage https://aws.amazon.com/ while the actual payload is...

Malicious code in mlflow-otel-instrumentor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b08cc23ea60cf80f9bf13850e8222ee1cbb7a89643362c703eb402eef08d908c Package metadata impersonates AWS author "AWS Support Team", email [email protected], homepage https://aws.amazon.com/ while the actual payload is...

Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

MAL-2026-14064 Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

MAL-2026-11197 Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83 On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 usi...

Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83 On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 usi...

MAL-2026-10985 Malicious code in animated-octo-spoon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54ed87d7e17e6be9f6e7c22f4f008e7a6326253127248f2c14f8a19390ac31 animated-octo-spoon 0.1.0 ships a 2.6MB Linux ELF binary named 'forge' a Rust-compiled CUDA GPU miner plus a launcher script start.sh. The package's...