Malicious code in secure-test-browser-7sktckna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1bfa6c399c7ff17284a9ba58f463a1a2f456b8bd3b5b792d8c91c27150c8a60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ggbh6tng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd4edd79ce6ac910c2bd864624e532a72b39bf24106a2ea33dca8657f0e1ec6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-izxyw11l (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dc39b8a648259a6fcd7fa6cf30221d4d35845af75ee3954b7d4320fb6a49f79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-2amz9mh0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12553fbd6b835470382809adf7416665112dc9da3674c4d4549334476f00b8ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-c2df2vbx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af04a5654e1e602a9413c75d3aac59bc47d341473d6bfe02eab71255253786ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-c5iac3qm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fa7356a903ebb6b6b821ec69557a0c88d08150498ef799f09da9f5f959e9613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15177 Malicious code in classlink-xx8vtk2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee0c9c321dee714b749d6271bd1457ffe6b8012b0aac1f0040fd42948bb8c25e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15456 Malicious code in secure-test-browser-y4yd7ndu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f792c1beb7268d7c12da9151f5f9596965848efd31f960cf9e5d9025a97fd8a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit.Malware-Development

No d...

MSC-2026-11519

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11520

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

To determine the real-world effectiveness of machine learning based malware detection, it is vital to evaluate its robustness against highly capable adversaries. However, state-of-the-art attacks do not effectively model realistic adversaries, as they often assume access to privileged information...

Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models LLMs offer strong semantic understandi...

MAL-2026-14578 Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

Malicious code in @hd-team/app-dnpkg-eight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ebbb10d70e38e5772506ebd2604502a39d4c462730a4a1f2c4f21147959af9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stackpaths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a27ce2899b65f55deaab5feaf1b3cfd2ae674a45fd3e87ab442c58d3d89ba79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sigcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6acb99271ede5807243bea2648af5e71511853e99c473309de457a8828ac0ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in veloq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0f85e80ad1893e8546161034450eaac2165d5eb7299710f0870bc26b05b2 [email protected] is a near-verbatim fork of gulplog rebranded by 'Blockvora Team', with two injected lines inside getLogger in index.js: a call to...

JavaScript obfuscation: From party trick to phishing kit

We open a JavaScript artifact hoping for code, and instead get string arrays, strangely named functions, encoded URLs, runtime decoders, and eval statements. That is the point where "reading the script" stops being enough. Obfuscated JavaScript is still code, but it is code with the useful contex...

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal , during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and...