Malicious code in kambxjowhdsgyw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 966589b88833a788509808e69f3fd935c370ff4093b9fc3fb50482431434a6b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in fdhcxvnwhjiofv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7125babb23f8900d46ed2c500ef373d4de463c6260810c17719922435bdac54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in luftmvfiwgxydes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e487d10b32b0e42f4ed6478fa461451bcacc8eb9d679a58931bc474c339feae7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," w...

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

RatHat Android malware uses generative AI to navigate infected devices, steal banking credentials, intercept OTP codes and reinstall itself after removal again...

MovieReaper Malware Uses The Odyssey Torrents to Infect Users Worldwide

MovieReaper malware spreads through compromised Odyssey torrents, infecting hundreds of victims while using Solana to locate command-and-control infrastructure...

Inside a Malicious, Stealthy WordPress Must Use Plugin

The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. The malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal. It also makes use of Etherhiding, a technique that hides the...

Malicious code in tldriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995 The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using...

Introducing CAIRN: Frontier tracking for AI-integrated malware

A cairn is a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear. Attackers building AI-integrated malware unintentionally and inevitably leave behind markers of their own: prompt templates, provider endpoints, API keys,...

A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight

Cisco Talos researchers created a new framework for identifying malware and hacking tools that rely on AI chatbots—and quickly discovered something unusual...

Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16376 Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-96963

Name of the Vulnerable Software and Affected Versions Crypt::SelfCertificate versions 1.01 through 1.05 Description This software contains malware that executes Python code retrieved from an obfuscated URL. The generate certificate function runs a Python script disguised as a certificate file,...

HYDRA: Proactive Android Malware Drift Adaptation Via Hierarchical Graph Contrastive Learning

Concept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are...

CVE-2026-95831: Embedded Malicious Code

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

Malicious code in wos-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0281f721b8645a472011b83299574bb7e74651a8f0e628c519bafb19b86938 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16373 Malicious code in wos-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0281f721b8645a472011b83299574bb7e74651a8f0e628c519bafb19b86938 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16368 Malicious code in mathmain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...