PT-2026-110107

Earth Sirrush has run a multi-year spear-phishing espionage campaign against Ukrainian government, defense, border-security, and logistics organizations since at least 2022, with activity and infrastructure linking through July 2026. Early operations delivered LONEPAGE, SEAGLOW, and OVERJAM via...

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan RAT codenamed ASHVEIN. According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company ...

Malicious code in index-error-cold-earth-encode (npm)

Source: amazon-inspector 600c58f15b415a9d7152de753764755c856d4f1b2801557141a9e6a851d05879 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-byte-earth-cache-tau (npm)

The package error-byte-earth-cache-tau was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in emulate-earth-socket-rain-epsilon (npm)

The package emulate-earth-socket-rain-epsilon was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in emulate-earth-lambda-iota-mock (npm)

Source: amazon-inspector e6ef28b45310e660baece35a53cab9f8cd79a0a7d8211394c43df03cc593fdd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

face-compare (>=1.0.1, <=1.0.2), pyhand-earth (>=0.0.11, <=1.1.0) potentially affected by CVE-2026-12570 via keras (2.4.2)

keras PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - face-compare =1.0.1, =0.0.11, =1.1.0 Source cves: CVE-2026-12570 Source advisory: OSV:PYSEC-2026-3856...

Malicious code in earth-protected-gamma-test-star (npm)

Source: amazon-inspector 607017a42bce9e56670763a33b409d170584375240403b448fd7b4741454f5f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in earth-small-scale-simulate-static (npm)

Source: amazon-inspector 49fb4a6ae7bf4b0905de3d73d4d9b8c46faf60e8c2e993b8f02590be8e6893e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in earth-visualize-abstract-beta-pipe (npm)

Source: amazon-inspector 9cdcb9e255cb40cbc9b3900e368a05edeb31be8f58530b34dcf7f168ad49aed6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in earth-beta-scale-meta-cold (npm)

The package earth-beta-scale-meta-cold was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in earth-grid-bad-visualize-warn (npm)

The package earth-grid-bad-visualize-warn was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in earth-wind-fork-orchestrate-notify (npm)

The package earth-wind-fork-orchestrate-notify was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in earth-omega-epsilon-error-compress (npm)

Source: amazon-inspector 947db336c7842edab7a9506dd0ad7679dd256b4f6583d8acf5c916ea9a792645 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview earth-visualize-abstract-beta-pipe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview earth-small-scale-simulate-static is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in authorize-omega-earth-abstract-assert (npm)

Source: amazon-inspector 4b37e4245c69163fdc9865e5df8850709887150c4fa34928d8f0fee271852eb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in assert-tau-eta-good-earth (npm)

The package assert-tau-eta-good-earth was found to contain malicious code. --- Credit: OpenSSF source...

face-compare (>=1.0.1, <=1.0.2), pyhand-earth (>=0.0.11, <=1.1.0) potentially affected by CVE-2026-9335 via keras (2.4.2)

keras PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - face-compare =1.0.1, =0.0.11, =1.1.0 Source cves: CVE-2026-9335 Source advisory: OSV:PYSEC-2026-3633...

face-compare (>=1.0.1, <=1.0.2), pyhand-earth (>=0.0.11, <=1.1.0) potentially affected by CVE-2026-12480 via keras (2.4.2)

keras PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - face-compare =1.0.1, =0.0.11, =1.1.0 Source cves: CVE-2026-12480 Source advisory: OSV:PYSEC-2026-3629...