Malicious code in mathmain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16368 Malicious code in mathmain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

A week in security (September 14 – September 20)

Last week on Malwarebytes Labs: New Android malware uses AI to steal bank logins and PINs Did an AI really try to break free from human control? Fake parcel delivery messages steal your card and bank details Flock cameras are tracking people as well as cars Revolut phishing texts appear days afte...

100DaysofYARA

100 Days of YARA 2026 100 Days of YARAへようこそ！このリポジトリは、この期間に作成されたすべてのYARAアイデアを保存する場所として機能します。作成した楽しいスクリプト、ツール、ルールはすべてこのGitHubリポジトリにコミットできます！当面は、関連するブログ記事、ウォークスルー、その他の考察は別の場所で公開してください : これっていったい何なの？ 簡単に言うと、100DaysofYARA...

Stress-Testing Structure-Aware Calibration of Malware Graph Neural Networks under Type Shift

Post-hoc malware calibrators can condition confidence on graph structure, but their structural inputs may leave the support represented by validation data under malware-type shift. We study this risk on MalNet-Tiny by holding out each of four malware types across three seeds, freezing a graph...

Malicious code in test89-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...

Malicious code in test890-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...

Malicious code in test8999-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...

MAL-2026-16286 Malicious code in test8999-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...

Malicious code in test899-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...

Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pyjstat-smooth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d The package advertised as a JSON-stat library ships a test module that, when the test suite is executed, walks the /app and /Users directory trees,...

Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @kartyk-github-org/takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16265 Malicious code in @kartyk-github-org/takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

vet v1.19.1

Find malicious packages, vulnerabilities and risky CI workflows before they reach production. Install • Docs • Commands • Policy • Discord !NOTE This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2. Why vet Yo...

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lyin...

Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80714d50d1dce2dbe400bba24113e27d669cc28dfc0d2b9194214a6322d3dc45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...