Malicious code in wezen-yakutsk-semantic-release-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a4e7b890fb897fd79c169693b6eeee61da5201a79ed6c751dd02c5fa61fae4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145999 Malicious code in pavo-hugo-winston-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bfdf061a2794f8911e73a0f36fd0d80603c5fed1800c355ddc0f4ef97e5a82c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146289 Malicious code in playwright-yonder-module-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b8a88d8d6c9de0dc9811395ffc27c01a2b4ffde660a8f412ebbeaa8db6930e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in achernar-spinner-phoebe-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d399212cce44da716b4453d28a2ae282d63b656a01555bce4c82940730649661 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149356 Malicious code in webdriver-mocha-mini-css-extract-plugin-acamar-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53af958770f4ad50cb7b1fa86e408b7c65cf53d5d6044488bb5a3d18fcca5da5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64435

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

Malicious code in riana-toge95-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ccdafe5d032e44aec717e135e03111720aa8533f436f1aca8776dbee7172a85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

How credentials get stolen in seconds, even with a script-kiddie-level phish

This attempt to phish credentials caught our attention, mostly because of its front-end simplicity. Even though this is a script-kiddie-level type of attack, we figured it was worth writing up—precisely because it’s so easy to follow what they're up to. The email is direct and to the point. Not a...

Android Trojan 'Fantasy Hub' Malware Service Turns Telegram Into a Hub for Hackers

Cybersecurity researchers have disclosed details of a new Android remote access trojan RAT called Fantasy Hub that's sold on Russian-speaking Telegram channels under a Malware-as-a-Service MaaS model. According to its seller, the malware enables device control and espionage, allowing threat actor...

MAL-2025-99497 Malicious code in anxious_starfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38fe21b67f9ef542a192992b1d01d67ca63516dd5fb1cb7ccbaa26943e17a1dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95112 Malicious code in invisible_crawdad_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db3f0548f9cb52ab973b5b4de60e7fbf393932b6769d190e8b373d90ff1b5bf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-ruwet67-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5c4cf84183d897424d68a46734079a127e159540ead70ccae2bb1c9acfb183 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-91068 Malicious code in tiara-kupang62-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ae217652dee300e746beeb7f58e17e54a4cb47880d05e839f4680ee8c00f7c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poised_tarsier_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0352d31c0ef60cd4108a1773f927ff1ba45f8138cf926bf5a1b5b7202a1dc4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fajar-kembang80-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c6c509a03b25c03d42f20813ef37b5f51d35e834d6f4f9e53f17179b83d82b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in great_squid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d997aa2faffb3f5aacc928490b5b4f18e3a27eea748aa48889a50759b1e4878a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Fantasy Hub is spyware for rent—complete with fake app kits and support

Researchers at Zimperium identified Fantasy Hub, a new Android spyware developed and sold as a subscription on Russian-language cybercrime forums. Malware-as-a-Service MaaS means cybercriminals rent out to malware to other criminals, complete with the infrastructure necessary to harvest and abuse...

CVE-2025-64494

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data e.g. names and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages...

A week in security (November 3 – November 9)

Last week on Malwarebytes Labs: Malwarebytes scores 100% in AV-Comparatives Stalkerware Test 2025 Fake CAPTCHA sites now have tutorial videos to help victims install malware Hackers commit highway robbery, stealing cargo and goods Android malware steals your card details and PIN to make instant A...

CVE-2025-64494

Soft Serve (Charmbracelet/soft-serve) does not sanitize ANSI escape sequences in user input, and does not sanitize git messages in some UI paths. Affected versions are prior to 0.10.0. The issue can enable fake-alert-like output due to unsanitized input, with related cleanup needed in printed git...