MAL-2026-15886 Malicious code in guci-wxrout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bb83d0fbcc9d1cd163b94168217fbe3cbe5a6bd365af14d47da094eeb7a1400 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in element-icon-guci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b47763652442a29a047d076f48a01b00f72f56af9bc28014f3cd4735f16e9f3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15880 Malicious code in element-guci-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43ee355ab038085d87ed11e81acc53a50163f14b617d54b7e9b9c31e800900a Package is published as an element-ui utility library element-guci-util, description '元素-ui 常用工具函数集合' but its main entrypoint contains no utility...

Malicious code in google-internal-cloud-audit-security-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62a38a595d0fcf5e869dc2cdd939d476de1fbd24253eb6afd383c08c959dfc34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google-cloud-internal-build-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1728b138f6952e0dc34092093671684665336dc895872005137581f1aa13fe93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

The U.S. Department of Justice DoJ has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. Searzhudin Tamirlanovich Aktulaev , 40, was...

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

The U.S. Department of Justice DoJ on Tuesday announced the takedown of a long-standing peer-to-peer P2P botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

Malicious code in @viertechjs/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a35c7b86ec1a4d9922b7c74dbdab948b868f8cf43a8f5c01053692e6a85803 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

vet v1.19.0

Find malicious packages, vulnerabilities and risky CI workflows before they reach production. Install • Docs • Commands • Policy • Discord !NOTE This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2. Why vet Yo...

Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft has published details about a Windows malware campaign it calls TerminalFix. The social engineering used to infect people is very similar to what we've seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a...

Infostealers are hijacking Claude accounts at users’ expense

Anthropic has warned some Claude users that criminals are using information stealers to take over their accounts. Rather than guessing passwords or intercepting two-factor authentication 2FA codes, the attackers steal the browser sessions that prove a user is already logged in. According to a...

Malicious code in @yane88/term-reqable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bede455ffb8df248983dc819abe214260d4d70582e54f60c9cf99e974f3bafa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15666 Malicious code in @yane88/workbuddy-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1067553b82d11f9e2a38c4d59dd3b450f722d5572fc8bb43765d5093f68cc23f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in matrix-by-lmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7231cfc70a9c0bfad0c50204a6524688f4cdc2bb17c14de1db6554e42c177ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...