Malicious code in crypto-bot-utils (PyPI)

Source: kam193 3ece4ae851dba85751377f47097bd30525eafdcbf8cd08b57d2a06aa3a02b367 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in cometlogger (PyPI)

Source: kam193 627a435be86fedd2eccd2f0af61fa8b19c8c12dd781fc1bdc064d836e1eff19a Multi-purpose infostealer, including grabbing cookies, files, information from cryptowallets; injecting code into discord application. This package is a builder for the actual malware --- Category: MALICIOUS - The...

Malicious code in chainutils (PyPI)

Source: kam193 149995e4a1c4d289fa58be2adcab4095dca7c429097ad6735afef8270e7e4cb3 During import, package triggers malicious code. First, it ensures persistency e.g., through the autostart registry key. Then, based on the encrypted config, an exfiltration demon is started. It registeres the instance...

Malicious code in cflashfiles (PyPI)

Source: kam193 d8c5174968b7dedf000076201fe6446018aa61048b6a77fc8bc42e16bb796fd9 Malicious clone of legitimate fsspec package. The code was modified to exfiltrate specific files on import. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in blackamerxs (PyPI)

Source: kam193 50486a7fa5636706a3c90bf515f6664c6cbb11aa127f9b3e95d7b38cf89c80c8 If run, the code in the package exfiltrates all files from the current directory tree. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-11-blackamerxs Reasons base...

Malicious code in bitcoinlibdbfix (PyPI)

Source: kam193 a5cb52fa4f2ac6a68416c59a513399e01bb388d5e238260b712a513db3d97233 It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage. As a context, it appears to be created to lure users seeking for help with the bitconinlib package:...

Malicious code in bitforger (PyPI)

Source: kam193 9dff60a2be2c253f919aae6a6724cd140df2a3ca9bdcca9e637ea74bc987ac0f When running the module, this package attempts - depending on the version - to exfiltrate user files, a screenshot, or crypto wallets data 8.1.4. Later continued under different package names. --- Category: MALICIOUS ...

Malicious code in bibit (PyPI)

Source: kam193 e944b3bd6b920bf1cfd786ed25cc65b504bd5701203981a460a9c162a0fc282d When running the module, this package attempts - depending on the version - to exfiltrate user files, a screenshot, or crypto wallets data 8.1.4. Later continued under different package names. --- Category: MALICIOUS ...

Malicious code in auto-backup-macos (PyPI)

Source: kam193 64b97d3c3597539dc5a2cc2d81491eb2a0350011b3d80ef927546bc30701f924 Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where the collected files are sent, as well as no access to the...

Malicious code in auto-backup-wins (PyPI)

Source: kam193 c75087101c3ef272d35e87c1e17c5455e788fec5b5aabb6a61c42362a180b30e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where the collected files are sent, as well as no access to the...

Malicious code in as89ufnaisufn (PyPI)

Source: kam193 e21c9860ca710010b7059d9284d8e2665c8163a8f1f351782e1a30f2037ce647 During import, the package automatically downloads and executes code that first acts as an infostealer and then starts code acting as a RAT. It connects with a hardcoded C2 server and waits for commands, supporting e....

Malicious code in aiogram-photo-updater (PyPI)

Source: kam193 62ec906fc563c8e7b6c22bb0dae1e739e6c3d8e24091105a8eafb292dae2f661 When run, the package exfiltrates files from a cryptowallet and modifies its executable placing an implant exfiltrating passphrase later. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

CVE-2026-15724

Progress ShareFile Storage Zones Controller (SZC) vulnerable to path traversal in versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can read arbitrary files, write to arbitrary directories, or check file existence on the server filesystem. Affected component: SZC; root caus...

CVE-2026-15724 Path traversal in Progress ShareFile Storage Zones Controller (SZC)

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on...

CVE-2026-15342

The project management platform Plane (versions 1.3.0 and earlier ) contains a multi-tenant authorization bypass vulnerability in its asset-management API . The root cause is that the API endpoints accept workspace slugs and asset identifiers as path parameters but fail to verify if the authentic...

CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

EUVD-2026-46310

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

CVE-2026-64825

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field...

Malicious code in agent-user-generate (PyPI)

Source: kam193 514af1dfd929068fabc7527812b99ec6a287c3601d7cf4ed1d29c55e74339fac Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code, exfiltrate TXT files and finally installs infostealers -...

Malicious code in a-oder (PyPI)

Source: kam193 f7e835cce84c3bd2876cea21212f1d41b81ee568e92e90bb0ba1e2c2a1ba1370 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-weaponized-golden Reasons based on the campaign: - files-exfiltration --- Credit: OpenSSF source...