CVE-2026-97230

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

New Browser Guard features add protection before and after you click

Most of us click on search results without knowing much about the website we’re about to visit. And once we’re there, it’s not always obvious when something isn’t quite right. Now, we’ve added two new features to Malwarebytes Browser Guard that will do even more to keep you safe online. Search...

Malicious npm Packages That Evade Defenses

This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution...

Malicious code in @baanx/domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15835cd2dd9f3338228b64c997a3d1c1c8950da602e34fbc2adb0435fd0af23c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16485 Malicious code in @baanx/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85072c161314c0eed152e07e4993e5f816b3b85d30fe7f22cabf850fb9ff0e35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-97230: Embedded Malicious Code

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

PT-2026-98314

Name of the Vulnerable Software and Affected Versions IO::Socket::SSL::SelfCertificate version 1.00 Description This software contains malware that executes Python code retrieved from an obfuscated URL. The generate certificate function runs a Python script stored as a certificate file located in...

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of...

Malicious code in @test1230504/probe-7f3k2m-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 941e9925e20dd460b4dc52c0981a140d58ed376e41b15457cbd6bcd5028ba0d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16470 Malicious code in z-deno-truth-bwhlsz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db0813755b79e157c644502848b1ff5af003fc82fb842b39676490d00f33e814 The package's exports field maps the ./package.json subpath to setup.js, so any consumer resolving require'z-deno-truth-bwhlsz/package.json' executes...

Malicious code in better-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d2f690a34e0e9b3a8df4caf676f30b542d8dc710033dc70ddf6e3c18ee3a1fa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in iso-datetime-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9db51cfb135f41debd79f82f4bd905994ecdb54d08811d3755ac66aed13cb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in semver-bump-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in debounce-throttle-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2799630960bce0578627557c1a8c41369d2a1556f9632d6491903f17f21d7a39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16453 Malicious code in semver-bump-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in caphsmgiwy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2be9097447a7359110650f7119fc6b9265bba96bea6a4814d5534e6cf4a4bd59 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tib2jcvowuyma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7dad69d2e0593c1c42f8b0e905a0b002d30bccf9ea14d59f2da6ac313c1a48 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kamafhbnowct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 646021a6b47fafd23415f7357b91660f4ce18545fa5f9b2ba370842c632fb92d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mob4zchvuine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f22c6a37f547c13e9444268b7cf9484c580ec5e15d5e6a1207bdcdfc7be2ff35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tuxcmdfhjkw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed907ab556a271a706db9227bfa0cd751f7a3dae9005bca41167ffdfc8be75b8 The package's only shipped file is an HTML page that mimics a Cloudflare 'Just a moment...' verification screen and embeds obfuscator.io-style...