Malicious code in juniperrun (PyPI)

Source: kam193 1fd79c13a84952cbede2a1b1de7ba5d43396a2c95866015cdf73c9ce0d9960f5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in otterload (PyPI)

Source: kam193 6860fc5e0584389884eadd8bf39289d71d5c8c6dc01ca64603f3af344be8d755 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in flintqueue (PyPI)

Source: kam193 603240baf11c5a5c77d3a008dcfad49b31026bca034692ecae35780a6f0e6855 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in marshrunner (PyPI)

Source: kam193 689d5b87d977bc368c98efb8cf42d53c25465575a667cd61337bb403dfdcb4fb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in sedgehaul (PyPI)

Source: kam193 1eccea61ba89da6dd32ddad1e54e70f52c5a2b2c9aeeced8a80e068ef63dccd4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in badgertask (PyPI)

Source: kam193 ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

MAL-2026-18220 Malicious code in skillward (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0f3fd922178c06b3eae3dfaaa0bce1469e7c2d70a010a6263b117e36874a72a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-35674

Description CVE-2023-35674 is a high-severity zero-day security vulnerability in the Android Framework. This vulnerability allows an attacker to escalate their privileges without requiring user interaction or additional execution permissions. The vulnerability occurs in how the Android Framework...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

Debinject

Debinject Inject malicious code into .debs MAINTAINERS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec VIDEO DEMO CLONE git clone https://github.com/UndeadSec/Debinject.git RUNNING cd Debinject python debinject.py PREREQUISITES python 2.x dpkg dpkg-deb metasploit DISCLAIMER TO BE USED FO...

Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion

A directory traversal vulnerability in the Preventive & Reservation compreventive component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1475 info: name: Joomla...

MAL-2026-18215 Malicious code in @grabcad/grabcad-shop-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889 The package publishes under the @grabcad scope but provides no real functionality: index.js exports a Proxy stub that no-ops every property access, a...

Malicious code in @grabcad/user-license (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a248afa43b99998214621142f85910afc980f1a664c8f6a227b523984f88ea49 The package ships a beacon.cjs module that is wired to run both automatically on install via package.json postinstall: node beacon.cjs and on every...

MAL-2026-18205 Malicious code in @tekmidian/pai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edec0655f6132f9a6bcf8c5025db3cbb86d2802ade88ab4f3acc6af4b3f40adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in journey-teste-shellhello (PyPI)

Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-journey-test-helloshell Reasons...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...

MAL-2026-18203 Malicious code in journey-teste-shellhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18200 Malicious code in @seggy116/next-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5c18734e8db92923153cc8bbf81fe90bcb53d5fe9d17a7640014d51e165dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...