Malicious code in crypto-key-utils (RubyGems)

RubyGems runs this gem's native extension script ext/crypto-key-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17590 Malicious code in coinmarket-utils (RubyGems)

RubyGems runs this gem's native extension script ext/coinmarket-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17614 Malicious code in wallet-backup-tool (RubyGems)

RubyGems runs this gem's native extension script ext/wallet-backup-tool/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17598 Malicious code in eth-keystore-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in hardhat-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d908da8470ad86669b080d267b57174ccd77e5fd6ed2c371c430d98e869f2b [email protected] is published under a name resembling the Ethereum development tool 'hardhat' but ships README, type definitions, and docs copied...

Malicious code in tiny-focusgroup-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6d210f6c61d0ec49fac4bf487a2d71966b1f3dd59653d8a8fdf12e04f9b306 [email protected] declares itself as a focus-group accessibility helper, but thunderboltRegistry.js runs an IIFE at require time that...

Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17343 Malicious code in @bellaxchuu/crystalred (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17383 Malicious code in @xatancchii/velycxbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17404 Malicious code in saturn-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17405 Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @kibt/www-nuxt-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...

Malicious code in css-scroll-state-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffa0affc34bac3fa24fcc7c67aae4d120066f4f856cb8b637bc04c6ca9d482c The package presents itself as a CSS polyfill but ships a payload file thunderboltRegistry.js that executes an IIFE at require time. The IIFE uses...

Malicious code in css-relative-color-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee0efef48c7d56201a037b237f11ec712853f86e74f6a00ef8011732b31363f1 The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses childprocess.execSync to execute whoami,...

Malicious code in css-logical-prop-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ffba65f80ee8f200199c8c90ebb6297b8590537c80ea50bb34874d91665b5f The package ships thunderboltRegistry.js which imports childprocess and invokes execSync with curl commands at multiple sites lines 30, 39, 47, 48. T...

CVE-2024-3094-XZ-Backdoor-Detector

설명 xz의 업스트림 tarball에서 버전 5.6.0부터 악성 코드가 발견되었습니다. 일련의 복잡한 난독화를 통해 liblzma 빌드 프로세스는 소스 코드에 존재하는 위장된 테스트 파일에서 미리 빌드된 오브젝트 파일을 추출하여 liblzma 코드의 특정 함수를 수정하는 데 사용합니다. 그 결과 수정된 liblzma 라이브러리가 생성되며, 이 라이브러리에 링크된 모든 소프트웨어에서 사용될 수 있으며, 이 라이브러리와의 데이터 상호 작용을 가로채고 수정합니다. 영향을 받는 버전 XZ Utils 5.6.0 XZ Utils 5.6....

Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion

A directory traversal vulnerability in the Preventive & Reservation compreventive component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1475 info: name: Joomla...

Malicious code in caoxiltts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23b18de964968b1d4f9333a1bcc5f247b3978f9fdc418f01f7e9a3c7bc578a62 The package advertises itself as a TTS inference helper but harness.run downloads two gzipped ELF binaries from a configurable host, verifies them...

MAL-2026-17469 Malicious code in infrabench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f8f2854fc15ef2f2a5d4c44b050aa9f3c87a7f5a832949390cf22ccd7882a6 The package's public API harness.runedge= downloads two sha256-pinned gzipped native binaries 'inference-core.bin.gz' and 'edge-conn.bin.gz' from...

MAL-2026-17500 Malicious code in @nagular/router (npm)

@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...