51 matches found
Malicious code in claims-accounts-lib (npm)
Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated list of Cloudflare-Workers hosts string-concatenated via...
Windows Download Stager, curl.exe
curl.exe -fsSL download + execute Windows 10+. Host compiled stager.exe via hoststager generate. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildcurlexedownloadexec, buildstagerurl class ModulePayload: info = "name": "Windows Download...
Malicious code in sme-rko-finance-front-operations-shared (npm)
Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js reconstructs hardcoded hosts via array-join obfuscation...
Malicious code in dolyame-ui-selectaccount (npm)
Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute dropper. The code selects a platform-tagged asset path...
Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)
Source: amazon-inspector bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb The package's main entry index.js requires./ext at module load. ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...
Malicious code in express-dever (npm)
Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array with RC4/base64 decoders, hex-numeric constant folding, 0...
Malicious code in bnpl-blocks-independent-bnpl-cards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063ad90855d7ee9b794ccc1e32a794000434fb6955e82152a4d4118ff8e3e266 On require of the package, index.js loads bridge.js which reconstructs attacker-controlled hostnames via array.join"" string splits...
Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0 On require of bnpl-blocks-independent-bnpl-open-api, index.js loads support.js which unconditionally executes at module load. support.js selects a...
Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...
Malicious code in class-weaver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4e45cdd0a93db2db56ae7fd2c348305a5ce7aeab9c6fb4b2331c2a547b2c5e7 class-weaver advertises itself as a className/theme utility keywords clsx, utils, styling; exports named classNames and twMerge mimicking...
Malicious code in hiveos-setting (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 36035629c3bde2cc0e1f5c5531cac6c4ece9ff587cc3c85a5e39bcafbded06d9 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...
Malicious code in lnatainstaller (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a613dbd371593bf6bcb7ae528a4d7d7dba2fedfc6670c8cb493bb5cbee18f734 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has...
Malicious code in @dz-lib/dz-cli (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec9421e5d1892420fe8194f8361f8c856ef3b31d6996e2554d840fc850e59a1e Any computer that has this package installed or...
Malicious code in autoadv (npm)
The package contains code to download and execute an infostealer payload...
MAL-2024-9265 Malicious code in cyberart (PyPI)
The package contains code to download and execute a reverse shell script. --- -= Per source details. Do not edit below this line.=- Source: kam193 a56fce758142261d4c665b192e7f292a8b9c89a750be3271fc2e1c784d886828 When imported, the package download and runs a remote stage - a reverse shell. To mas...
Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar
CVE-2023-38831 WinRAR Exploit Generator Created by: tech...
Exploit for Protection Mechanism Failure in Artifex Ghostscript
PoC exploit for CVE-2024-29510, a Ghostscript format string vuln...
Malicious Package
Overview DiscordsRpc is a malicious package. This package contains malicious code that executes covert scripts upon installation or uninstallation, communicating with a remote server to download and execute additional malicious files, thereby deploying the SeroXen RAT on the victim's machine, all...
Malicious Package
Overview Modern.Winform.UI is a malicious package. This package contains malicious code that executes covert scripts upon installation or uninstallation, communicating with a remote server to download and execute additional malicious files, thereby deploying the SeroXen RAT on the victim's machin...