Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Enrich Zeek logs with host information To enrich all logs with an id field, use the tag ".-all". To enrich all logs with an id field, and the Known Entities, use the tag ".-known-all". To only enrich the conn.log, use the tag ".-conn". To only enrich the conn.log, and the...

Malicious code in zagents-message-bus (PyPI)

Source: kam193 0d1891d5d76adad51e120baa41752f0cc878b243eb400e7a12aba1616d31d1f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

MAL-2026-18296 Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

AgentSmith-HIDS

AgentSmith-HIDS --The name of this project was inspired by the movie - The Matrix English | 简体中文 THIS REPO IS OLD RELEASE VERSION: https://github.com/bytedance/Elkeid About AgentSmith-HIDS Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System HIDS due to lack of rule engine...

Malicious code in moveworks-capi-starter (PyPI)

Source: kam193 2cd8f99409a87f01743f65f381fefa800176a29d47d6119743ae2bd0ce1f7583 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...

MAL-2026-18122 Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...

Malicious code in trijigo-kalip (PyPI)

Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

MAL-2026-18114 Malicious code in trijigo-kalip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in trijigo-kalip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in workalender (PyPI)

Source: kam193 bb4f2824499fd64a22d9dfdb23c454bbb8797422f5281fdd5f454ea64095853a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

MAL-2026-18096 Malicious code in workalender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb4f2824499fd64a22d9dfdb23c454bbb8797422f5281fdd5f454ea64095853a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in asurion (PyPI)

Source: kam193 05820dd77e1f73d1a01797af6f10c6fa4ae22038be3fcd6a8cbd8c117cf6436c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in asurion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 393ccbeed4c71a6a21a3a697f0809845dddec09ddc8884662f40e2b2257a28a9 setup.py executes at pip install time and POSTs a JSON payload containing the full os.environ dictionary along with hostname, username, current worki...

MAL-2026-17763 Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

Malicious code in wix-ssr-thunderbolt-grid-polyfill (npm)

Source: amazon-inspector b6e0013701f6ab53085883b09092f0cd5ae9aaaab51a9f0e9de5aa68946ae9e1 The package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstrap batches in rbwixui.thunderbolt.manifest.min.json under...

Malicious code in erc7730-hackathon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17628 Malicious code in erc7730-hackathon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...