SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool RAT families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT,...

Malicious code in commonweb-balance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7455a26ab96be134244f14c67b9e3fbf63033f1b974cf45ad0620d5a6eda0581 [email protected] is an empty shell package empty index.js, no functionality whose only effect on install is resolving its single declared...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

MAL-2026-12880 Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

“Adult TikTok” searches lead to scams

Search for certain combinations of "TikTok" and adult content, and sooner or later you'll land on a page promising exactly what you searched for: an endless feed of explicit clips, no signup required, just tap and watch. There isn't one. On the other side of that click is an ad funnel dressed up ...

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload...

MAL-2026-10683 Malicious code in formatters.ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname,...

MAL-2026-10641 Malicious code in polygon-toolkit-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f56f0404b5e3f35ed475dae417f9351d4d149e163598eb72380fb6c025099e12 The package presents itself as a web3/polygon validator but its exported API silently relays caller-supplied data and generated cryptographic materia...

MAL-2026-10627 Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

Malicious code in lusha-iam-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46142505b88a255674663ced6e8bce8c8f3e28c0936e463e07463a7e1331e5af package.json declares the node-fetch dependency pinned to a tarball URL on registry.ctzbg.com, a host unrelated to the npm registry and unrelated to...

MAL-2026-10517 Malicious code in @tqm-mfe/main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba70610a96625984d6a26c5cfba828a98fad70a559f34eb881289f9ce4f625a1 scripts/postinstall.js is a heavily obfuscated obfuscator.io-style: 270+ entry rotated string array, RC4+base64 decoders, hex-encoded dispatchers...

Malicious code in nodemon-delog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1c5b4054d6daffaf190005db661027e29255ae20de1bb410f506de1f178532 nodemon-delog is published under a name that resembles the widely-used nodemon package and ships a verbatim copy of nodemon's source tree, README,...

Malicious code in node-path-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...

MAL-2026-10463 Malicious code in node-path-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...

MAL-2026-10452 Malicious code in markdown-editable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b15669732f3eaec42e12c5f8d41a8f74d595fc04f709804de9768cb1719a94 The package's package.json declares a preinstall hook node index.d.js that runs automatically on npm install. The script in index.d.js base64-decodes...