Malicious code in otterload (PyPI)

Source: kam193 6860fc5e0584389884eadd8bf39289d71d5c8c6dc01ca64603f3af344be8d755 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in taskquay (PyPI)

Source: kam193 692f4bcca72a6b53c989001619446e8b3b5bd66716674ca8230baa6d9d4c60a5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in loadferry (PyPI)

Source: kam193 6d5ed5a4ca84e5e36cc5a87ee1ef6652bb96f1dbe1ef3340a041060c6bb9f477 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in flintqueue (PyPI)

Source: kam193 603240baf11c5a5c77d3a008dcfad49b31026bca034692ecae35780a6f0e6855 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in sedgehaul (PyPI)

Source: kam193 1eccea61ba89da6dd32ddad1e54e70f52c5a2b2c9aeeced8a80e068ef63dccd4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in brambletask (PyPI)

Source: kam193 922435cd67a39583e0143229da6822f691940fcea9f4b4b18203faa594a1debc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in marshrunner (PyPI)

Source: kam193 689d5b87d977bc368c98efb8cf42d53c25465575a667cd61337bb403dfdcb4fb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in juniperrun (PyPI)

Source: kam193 1fd79c13a84952cbede2a1b1de7ba5d43396a2c95866015cdf73c9ce0d9960f5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in kestreljob (PyPI)

Source: kam193 4a86144582538adae41c5d2f14f22daae1f65ecf9b93cdeb0d82889681af9222 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in badgertask (PyPI)

Source: kam193 ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

mal_unpack

malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: malunpack.exe...

fickling

Fickling Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle object serializations. You can use fickling to detect, analyze, reverse engineer, or even create malicious pickle or pickle-based files, including PyTorch files. Fickling can be used both as a python libra...

MAL-2026-18220 Malicious code in skillward (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0f3fd922178c06b3eae3dfaaa0bce1469e7c2d70a010a6263b117e36874a72a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-35674

Description CVE-2023-35674 is a high-severity zero-day security vulnerability in the Android Framework. This vulnerability allows an attacker to escalate their privileges without requiring user interaction or additional execution permissions. The vulnerability occurs in how the Android Framework...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

CVE-2025-56383-Proof-of-Concept

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. The example method is as follows: Please note that the following demonstration uses npp.8.8.3.Installer.x64.exe to install Notepad++for testing, but in reality, any installed...

Debinject

Debinject Inject malicious code into .debs MAINTAINERS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec VIDEO DEMO CLONE git clone https://github.com/UndeadSec/Debinject.git RUNNING cd Debinject python debinject.py PREREQUISITES python 2.x dpkg dpkg-deb metasploit DISCLAIMER TO BE USED FO...

CVE-2024-3094-checker

CVE-2024-3094 checker xz Utils versions 5.6.0 and 5.6.1 appear to be compromised. XZ Utils is data compression software and may be present in Linux distributions. The malicious code may allow unauthorized access to affected systems. Sources: https://vulners.com/cve/CVE-2024-3094...