Malicious code in colonial_moose_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c899f2c7823361bfb7e7a0e13863a800f73037767304d5b839de2753307c595f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-83212 Malicious code in andi-ruwet59-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02474cf8e6d45ac3a34b9575f53d9d2cf46b75f9654e8ee0d8ccdaca8184b3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurnia-gembus21-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bd933b0cd1f7db660cd8b8ac616eb66dc0ad5597b5ad7cda24bec93e64f8c01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-79460 Malicious code in kurnia-oncom52-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d656180a123fdda7c580799e4640ab27ece9ddee8498731ed48c4032ada0caa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-mangga51-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05759887b34d3f3561a5622bdc0e50054240ff469b3ebfe7b220ada66f056e1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gleaming_gibbon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b488198306b2941164f225773ee9ebb1b844c29bbf00dc015d0b44604c740d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-oncom28-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421f5e4cb795b25639ae810d5d23c959260792d6541ca91b3c4e083ad2e63e8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in udin-kue87-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbfcf9b5d9d7e286e613fad11cbfd581fea6c290c595933adb7e5873df40f737 The package udin-kue87-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-50533 Malicious code in tiara-rendang11-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19c4a3ad001aa9ceab2186c6d84bdb8b87176052ae43f79ecdac3f450f5ced86 The package tiara-rendang11-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50419 Malicious code in fauzi-naget15-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e2de0b6e0a55bf43d708c5dc88a5a23dc72ebed7d5d76e6b74d927da82889d The package fauzi-naget15-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-191876 Malicious code in speedd-testing-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2aaec37a58d7717b510aa569770af696e33ae7f9a59e733af3d6341d712f0d66 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...

Malicious Perplexity Comet Browser Download Ads Push Malware Via Google

Attackers are exploiting Google Ads with fake Comet Browser download links to spread malware disguised as Perplexity’s official installer. The campaign, tracked by DataDome, has ties to DarkGate...

Cyber Warfare during Operation Sindoor: Malware Campaign Analysis and Detection Framework

Rapid digitization of critical infrastructure has made cyberwarfare one of the important dimensions of modern conflicts. Attacking the critical infrastructure is an attractive pre-emptive proposition for adversaries as it can be done remotely without crossing borders. Such attacks disturb the...

Self-Replicating Worm Hits 180+ Software Packages

At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub , experts warn. The malware, which briefly infected multiple code packages from the securit...

CVE-2025-59038

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fix...

CVE-2025-59038 Prebid.js NPM package briefly compromised

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fix...

The Price of ‘Free’: How Nulled Plugins Are Used to Weaken Your Defense

The Wordfence Threat Intelligence Team has discovered a new malware campaign that highlights the hidden risks associated with "nulled plugins", or premium plugins that have been tampered with by third parties. This campaign is particularly concerning because it doesn't just infect websites: it...

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT. The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon...

Malicious code in xenlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e53ee4ee9935e6502ce16df23a8110b5cccba018b9c0c14279ebabc163e84265 Package is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is plac...

An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via ‘Cracked’ Apps

Trend™ Research analyzed a campaign distributing Atomic macOS Stealer AMOS, a malware family targeting macOS users. Attackers disguise the malware as “cracked” versions of legitimate apps, luring users into installation...