Malicious code in pentest-copilot (RubyGems)

Source: ossf-package-analysis 8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019 The OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in pentest-copilot (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32 The gem declares an extension script mkrfconf.rb / RakeBuilder that runs automatically on gem install. At install time it collects installer-side...

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 EXPLOIT TO USE IN METASPLOIT, ALLOWS ATTACKERS TO GET AN REMOTE CODE EXECUTION THROUGH MICROSOFT OFFICE WORD BY INJECTING MALICIOUS CODE IN THE FILE...

inspec_cve_2019_15224

a malicious rest-client gem On August 19, 2019, it was discovered that the rest-client gem had had several versions published containing malicious code. In discovering the malicious rest-client, several other new gems were determined to be carrying similar code. Coverage:...

MAL-2026-19153 Malicious code in pdf-html5-page-flip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3ff36ac8518eded0b7acb87f26ae3d704ff2924722ac2415450afc1ae32a869 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

CVE-2024-3094-Vulnerabity-Checker

CVE-2024-3094-Vulnerabity-Checker Verify that your XZ Utils version is not vulnerable to CVE-2024-3094 ┌──lypd0㉿kali- └─$ ./CVE-2024-3094checker.sh / / \ / \ \ /. | / \ / \ /. | \ / / / / / \ \ / \ / / / / / You are NOT vulnerable to CVE-2024-3094. Background CISA Cybersecurity and...

GuardModel

GuardModel Block malicious AI models in your pipeline with one line of YAML. GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickl...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

CVE-2025-56383-Proof-of-Concept

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. The example method is as follows: Please note that the following demonstration uses npp.8.8.3.Installer.x64.exe to install Notepad++for testing, but in reality, any installed...

MAL-2026-19118 Malicious code in 0sec-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

CVE-2024-3094-checker

CVE-2024-3094 checker xz Utils versions 5.6.0 and 5.6.1 appear to be compromised. XZ Utils is data compression software and may be present in Linux distributions. The malicious code may allow unauthorized access to affected systems. Sources: https://vulners.com/cve/CVE-2024-3094...

vbSparkle

What is vbSparkle ? vbSparkle is a source-to-source multi-platform Visual Basic deobfuscator based on partial-evaluation and is mainly dedicated to the analysis of malicious code written in VBScript and VBA Office Macro. It is written in native C and provides a .Net Standard library , and works o...

mal_unpack

malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: malunpack.exe...

fickling

Fickling Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle object serializations. You can use fickling to detect, analyze, reverse engineer, or even create malicious pickle or pickle-based files, including PyTorch files. Fickling can be used both as a python libra...

Malicious code in chalks-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0989c6b31e99988848556608782ed4e28d21b14b9360324463765752195636d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in termchalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b41f585c4e82520cf84ca20367823520bced473a6fbc03f50ab77c7c5bb83e77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion

A directory traversal vulnerability in the Preventive & Reservation compreventive component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1475 info: name: Joomla...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...