Malicious code in pytablute (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89c8605077eecd12f249b3698da0cc2b60f54ecca01041a16221882d1ee6a4b1 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in dolyame-ui-clickoutsidehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g...

Malicious code in ai-spellcheckers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 205425d7a8407b8bed958a99660e2ec74e21f9b0e1427659529636347333c5c9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in tablixs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46731b2531e50115b70ae49abbd4bd1abb55f364a4cc2d8234c749f750883359 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

CVE-2017-20203

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

Malicious code in posi (PyPI)

The package contains code to download and execute a reverse shell script. --- -= Per source details. Do not edit below this line.=- Source: kam193 9eff1140edfe020fe3ef5905579f5e5d74a8cd0638332576041513ce894eb27e When imported, the package download and runs a remote stage - a reverse shell. To mas...