Malicious code in crenelatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ccd88fc743d2fd427510543af873fff8780bb4ec4916a565afb729315f28068 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in journey-test-helloshell (PyPI)

Source: kam193 bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9 In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-journey-test-helloshell Reasons...

MAL-2026-18125 Malicious code in @worrisome/aaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a40fa46e41f398f4bc4d74e11b8ff064d691a5c5a9b8950003f93e76e114b5b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in journey-test-helloshell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b setup.py registers a custom install command cmdclass install hook and also fires at module import that connects to the hardcoded bare-IP endpoint...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

CVE-2025-32965-xrpl-js-poc

CVE-2025-32965 — xrpl.js Supply Chain Attack PoC Report Vulnerability Description CVE Code: CVE-2025-32965 Vulnerability Type: Supply Chain Attack CWE-506: Embedded Malicious Code Target: xrpl.js library versions 4.2.1–4.2.4 and 2.14.2 Impact: User's wallet seed/secret data sent to the attacker...

mal_unpack

malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: malunpack.exe...

CVE-2024-3094_xz_check

CVE-2024-3094 xz Check Script This repository contains a Bash script and a one-liner command to verify if a system is running a vulnerable version of the "xz" utility, as specified by CVE-2024-3094. See the description and impact statement below from information available via RedHat...

Malicious code in hijiko-pilaka (PyPI)

Source: kam193 1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testin...

Malicious code in facewareretargeter (PyPI)

Source: kam193 3d3c954fb5fd6d1ddfc1d5e22129468136fb43fe78c6d69f0df134925b6a8b08 The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testin...

are-you-get-tanstack-attack

TanStack Router CVE Scanner A security scanning tool to detect the TanStack Router CVE | TanStack Router GHSA in your projects. Overview This tool scans your codebase for indicators of the TanStack Router vulnerability CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx, which affects specific versions of...

CVE-2026-33634-Scanner

CVE-2026-33634-Scanner Automated scanner for detecting indicators of compromise IOCs associated with the TeamPCP supply chain attack CVE-2026-33634 📋 Table of Contents Overview Vulnerability Features Detected IOCs Installation Usage Examples Report Format Project Structure System Requirements...

MAL-2026-18112 Malicious code in hijok-lampam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8944d571e7af6e23f5c6c984859f38e1336fcfeee595dfabca635477cfe38045 The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical...

MAL-2026-18113 Malicious code in jiklpo-tsunari-kay (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82ef4d01da7de20aa2e477bb07e1daa97855cdf33d186579da5cf148e3d4be0e The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical...

MAL-2026-18111 Malicious code in hijiko-pilaka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical...

MAL-2026-18110 Malicious code in facewareretargeter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afcd41ab1e378f4c7d767acb2b9e9199a4276e125d6e84aba3627bf37c879f24 facewareretargeter 9.9.9 ships a 2-line stub module and a setup.py whose installrequires declares a single dependency, tracer-batch-stream-chain,...

Malicious code in semmver (PyPI)

Source: amazon-inspector 8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594 The package is a typosquat-style empty stub semmver/init.py contains only version = '1.0.0' whose only functional code is in setup.py. At pip install time, setup.py calls urllib.request.urlretrieve to downlo...

MAL-2026-18102 Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

MAL-2026-18101 Malicious code in semmver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594 The package is a typosquat-style empty stub semmver/init.py contains only version = '1.0.0' whose only functional code is in setup.py. At pip install...

Malicious code in semmver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594 The package is a typosquat-style empty stub semmver/init.py contains only version = '1.0.0' whose only functional code is in setup.py. At pip install...