GuardModel

GuardModel Block malicious AI models in your pipeline with one line of YAML. GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickl...

CVE-2024-38526

CVE-2024-38526 - Polyfill Scanner: x Mass Urls Scanner The polyfill.io CDN, previously compromised to serve malicious code, has now been secured with the latest fix in pdoc 14.5.1. Overview Detect potential issues Automate repetitive tasks with ease Features High Confidence Alerts : Detects scrip...

node-ipc-malware-protestware-CVE-2022-23812

CVE-2022-23812 RIAEvangelist/node-ipc is malware / protestware The RIAEvangelist/node-ipc module contains protestware peacenotwar. Excerpt from RIAEvangelist/node-ipc: as of v11.0.0 & v9.2.2 this module uses the peacenotwar module. More importantly, commits 847047cf7f81ab08352038b2204f0e763344958...

CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARN

CVE-2026-22008 – AWS Lambda Layer Injection via Shared Layer ARN Program Code Python deployvulnerablelambda.py - Lambda function using a layer from untrusted account import boto3 lambdaclient = boto3.client'lambda' Attacker publishes a public layer containing malicious code Victim function...

CVE-2026-67595

CVE-2026-67595 — Embedded Malicious JavaScript in VaahCMS Security advisory for CVE-2026-67595 : an obfuscated JavaScript spyware payload shipped inside the official releases of VaahCMS a supply-chain / embedded-malicious-code issue, independently discovered and reported by Ilhomjon Rustamov...

Malicious code in log-rotate-testmetest (npm)

Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's implicit node-gyp rebuild to execute index.js at install time...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

Malicious code in log-rotate-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's...

threatDemos

🚨 Android Security Threat Demonstrations Repository A comprehensive collection of proof-of-concept Android security vulnerabilities and attack vectors This repository serves as an educational resource showcasing real-world Android security threats and their corresponding mitigation strategies. Ea...

Malicious code in ttsprobe (PyPI)

Source: kam193 d041a8df49e0f66f27d5f26370aa9bfee89b0ede347cb57f201f3359713e8c2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in voxweaver (PyPI)

Source: kam193 98de0e1f12e0c4b69583e08c1cd46876975b49c6803d93483c136ee2f6e62f68 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsweaver (PyPI)

Source: kam193 cf25be0936bf389bd4c150fdda0e6801d5916e7d3c386695ece9360dbb39c085 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in vocabblend (PyPI)

Source: kam193 f512985b20dc469ed3bd4e8e382b358fdbffa1153f5fcadb3d6dfeeaeeac84a0 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in voicekit (PyPI)

Source: kam193 963d403cf4d9c68ae8a3047dba639793fc4669e0953662c923c9a1eacb5f5402 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsflow (PyPI)

Source: kam193 ca06c0d356aef80eb13ae19e8a7e17cacdb0e1d3b1ba0f250387d8b18d110395 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in vocabbench (PyPI)

Source: kam193 dc5566e2e9fb4803c51425e840aa5d7979e11fc4263d12dc29fedbd472acb5cc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ttsdock (PyPI)

Source: kam193 cd67309a16135e30efc3aad2f8d234cc48fed3ffdaa4d32b6345cc368963e775 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in modelworks (PyPI)

Source: kam193 cd8881d21166c1b1d9e519b92d85228a8df0520e31bd5a3d6a3606513b66047a This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in speakbench (PyPI)

Source: kam193 5261cd9950cdef43aa82af72e1a479d8668a37b06d1fce0a6b8ff869e0620ed2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...