MSC-2026-11473

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11468

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11449

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

isms-builder v1.37.5.3

ISMS Builder Self-hosted Information Security Management System — open source, no cloud required ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged "releases", installers, or downloadable ZIP files — the only legitimate source is this repository,...

Malicious code in fivem-tool-helper-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b33a1f643603b3bbf0f4e15b104240715e0de6a10025eeeafb9b015d684ca5f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SkillShield: Prompt-Space Security Skills for LLM Coding Agents

A coding agent edits files and executes shell commands with its developer's privileges, allowing malicious requests to translate directly into harmful actions or functional malware. Existing defenses have complementary limitations: weight-level alignment is unavailable to API-only deployers,...

yara-x v1.20.0

YARA-X YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malwar...

Malicious code in text-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163de9a9fb651da86f266476767aea6f3b53b316ad3a3b269d469e6447fe43bd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-streak-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b054f1d8e8f496e3bdabacf1bf5042b2aba5f9587646cbb874ae9e3ec9c7c7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14494 Malicious code in svelte-goal-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599aa19770a72a0fa6e983e317d13b3647eaf8412d4b5b7ff10067be4ed34c82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14490 Malicious code in mkb-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27bc086d2159cad3d4eb02427ea2daa5f66ad57c39cbbaad5a8bb367071f4fb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-66882

creationtimestamp| type| source ---|---|--- 2026-08-25 09:14:39+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtvi65yggp2t...

Malicious code in desmosschoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9575a8846e102604d72f61d91f37c559e58d0fca4c117008257d096afc2a2acb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in schoolhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207beec4a342cd3a46c5a21ea6b76c3e84e88374f40a76b6c5761859a76ea2c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in schoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fab9688948b5e3cab55bea7282280a554f1e60f85b947724b5f9262cd6a1823 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in whatsgoodlookingbabycreed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e598067256b5fe5407b1f8b201925a118b6a08ea19be59cc80db3c60082fe19b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

GHSA-HQ2V-CGW4-FW2W

creationtimestamp| type| source ---|---|--- 2026-08-25 02:24:00+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtur7ukixg2v...

CVE-2026-56708

creationtimestamp| type| source ---|---|--- 2026-08-25 02:24:00+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtur7ukixg2v...

CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days

Executive Summary ShieldBreak CVE-2026-69414 is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigne...

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike...