42697 matches found
MAL-2026-10994 Malicious code in app-data-ist (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...
MAL-2026-11010 Malicious code in calvora (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d42150b238e61e7ade93da3750393fdd09523b36d5794ed80e57c6a183029a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11019 Malicious code in veskr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af373607b79177ffadde79de1f78b4c5490a04cc5cdf41a925cf42e234fc867a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11008 Malicious code in caldryn (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c9fe8dc148d9aeea38bde81a4c2c467769c550580a8394dbbef1152aea36ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-61391
creationtimestamp| type| source ---|---|--- 2026-07-22 15:15:31+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrami5nycm2j...
Malicious code in streak-daycount (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5a02c91969e01fc57050b8fabfc6abe2e50b9455cdaa4357791d24546b5623a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10981 Malicious code in streak-calendar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
CVE-2026-16408
creationtimestamp| type| source ---|---|--- 2026-07-21 14:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5yga5vpe2q 2026-07-21 14:12:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yj722mj2u 2026-07-21 21:00:06+00:00| seen|...
CVE-2026-16445
creationtimestamp| type| source ---|---|--- 2026-07-21 14:08:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yatv4py2e 2026-07-21 14:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr622tzdcl23...
GHSA-Q5FW-VPQC-FGPH
creationtimestamp| type| source ---|---|--- 2026-07-21 13:18:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vhspcma2g...
GHSA-FV8Q-RWJ8-2C55
creationtimestamp| type| source ---|---|--- 2026-07-21 13:15:17+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vc7infg2e...
New ClickLock Stealer locks your Mac until you hand over your password
ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...
MAL-2026-10940 Malicious code in chai-leaf (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38312fd425c2921477fe6eecb5036500bcdbc1735dee43f3a84cfcbf2ba3002f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11001 Malicious code in date-format-utils-xz (npm)
The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...
GHSA-GCJP-F7JM-RRRG
creationtimestamp| type| source ---|---|--- 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e...
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence AI skills or Model Context Protocol MCP servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit...
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering ...