Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code

Malware authors have traditionally relied on polymorphic techniques to produce variants in the same malware family, complicating signature-based detection. Integrating generative AI into offensive toolchains enables attackers to synthesize structurally diverse payloads with identical behavior,...

HTTPS Fetch, Windows Command Shell, Reverse All-Port TCP Stager

Fetch and execute an x86 payload from an HTTPS server. Spawn a piped command shell staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options msf use payload/cmd/windows/https/x86/shell/reversetcpallports msf payloadreversetcpallports show actions...

MAL-2026-2281 Malicious code in roboats-addition (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9c3e8c3efcca9a56765d765638b1f7a25769a8a94693c4f391804337be55fcf During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in anistream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57e4902ca2172a78b93acf6ec1413ab098e72c158dc1ab74c3a84f28f50382f1 Package hides code that downloads and runs malware, likely an infostealer. The code is not directly called in the package suggesting it's a dependency or next...

K000159707: NPM vulnerability CVE-2025-59145

Security Advisory Description color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added...

`sha-rst` was removed from crates.io for malicious code

This crate was used as a dependency by finchclirust and finch-rst and contained a malware payload to exfiltrate credentials. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above that were part of the attack, no other crates...

MAL-2025-186694 Malicious code in elara-hexo-postgres-astrochemistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4068ecfde3f050b2eb3b2da7f67d43a1e892a4a4b0f4124c4635ec96c99f44ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188879 Malicious code in prosthetics-leda-mantle-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02ccf110939f33fbfa2672f6cba59b7579228e554de159d0d913b20d0526171 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lomi-fus-uga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7f461f247f76b7a3ddfa88fd0899201795776834054eaa8aae013f6ae95c911 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183698 Malicious code in manu-oi-gsisofai01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e8a471912b33b6e4113f390d5ffa2f3bfd3d57e4635eec9141c9a56c1d1247 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185200 Malicious code in sonic-os-afisigaafoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd5f828fb8cdb811ae8ed2b9e4dc1bf718b7b70d3bf5a29df399152c0f4b8db7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179937 Malicious code in lookingan-nanakila120 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e4f19be8bdef8d85135022dfbb8d785e27d9471f3cd89d51f873e9be23f96c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymer-id-doraema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 552229e2f5e7b2dd80a5991ecce31289fd7eececa58ed576a47ff227a1659c55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in godi-tua-in0dtdc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c86f2729f64e618a5238a55aa7ed18d00fcbc56490948b8f0bd9fd163edc6f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in augis-pomdoui9r-mafodfna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5166450f59a28c40264c420bba5d07e1899a7a08020c3ac07b5e93fd136fbb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171717 Malicious code in pedrohenrique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc26c021e338605bf2684ef0008d77eecb814713a031774839ee4f7eaaa88a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nasrul-poke25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ff90478af98dbce70c11c0dafb90c7e20f7de05daf43dfe362f9fc027e3130 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @miptaa02/mqwjsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe26b96d9a17242e214832f65bc4f2013bbaae6a21e1a1a5d4199a6c333a02f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alita-poke22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b8d64b3841315713d4be4dd4253771ff3abebc1aded8d916054d5e0941ebaf6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...