twoface

"Two-Face" Rust Linux binary An executable file that runs a harmless program most of the time, but will run a different, hidden code if deployed on a specific target host. See Creating a "Two-Face" Rust binary on Linux. Usage You need a Rust build environment for example from rustup. A nightly...

Malicious code in chai-as-sleek (npm)

Source: amazon-inspector 782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the...

Hiding Prompt Injection in Legal Filing

Someone hid AI instructions into a legal filing. Alternate link...

MAL-2026-15560 Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

MAL-2026-15558 Malicious code in mfakit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f11dc9d39df6906a4b784b0cb3a584b5307816d20c4cc04fb28bbb40f59c3fb8 The package advertises itself as a lightweight Discord MFA library, but require of its main entry loads lib/cache.js which schedules a setImmediate...

Malicious code in ranux-cloud (npm)

Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded AES key/iv/aad to decrypt an embedded 2.3 MB opaque blob...

Malicious code in @nestjs-passport/jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3060c9289c475e223c1c00bc21a0f59f8aa5b18e31bfaee6e4d923eab0042f Package published under the @nestjs-passport scope, which resembles the official @nestjs/jwt and @nestjs/passport packages. The sole entrypoint files...

MAL-2026-13627 Malicious code in @nestjs-passport/jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3060c9289c475e223c1c00bc21a0f59f8aa5b18e31bfaee6e4d923eab0042f Package published under the @nestjs-passport scope, which resembles the official @nestjs/jwt and @nestjs/passport packages. The sole entrypoint files...

Malicious code in hardhat-set (npm)

Source: amazon-inspector 7cf6b9d0ee4a23bfab6e7a3c21f69a36e0655019cf1dd602f93760e233c7f701 The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project github.com/pinojs/pino, while package.json declares author 'Rober...

Malicious code in hardhat-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf6b9d0ee4a23bfab6e7a3c21f69a36e0655019cf1dd602f93760e233c7f701 The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project...

MAL-2026-13609 Malicious code in hardhat-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf6b9d0ee4a23bfab6e7a3c21f69a36e0655019cf1dd602f93760e233c7f701 The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project...

Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...

Malicious code in supersig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5 The published dist bundles dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js, reached via the package's main/module/browser entries on...

Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...

MAL-2026-13217 Malicious code in akamai-sensorv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors FE00-FE0F...

Malicious code in akamai-sensorv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors FE00-FE0F...

Malicious code in akamai-sensorv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf The package hides an executable payload inside a block comment in index.js using Unicode variation selectors U+FE00–U+FE0F and U+E0100–U+E01EF...

MAL-2026-13216 Malicious code in akamai-sensorv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf The package hides an executable payload inside a block comment in index.js using Unicode variation selectors U+FE00–U+FE0F and U+E0100–U+E01EF...

Malicious code in bigops-nitro-events-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of thre...

MAL-2026-13301 Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...